CVE-2026-102278

npm/brace-expansion CVE-2026-102278: high 7.5, EPSS 0.35%

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Action: Upgrade brace-expansion to 1.1.20 or later.

npm i brace-expansion@5.0.11

npm i brace-expansion@3.0.8

npm i brace-expansion@2.1.6

npm i brace-expansion@1.1.20

Affected

Fixed versions

Sources

• osv: GHSA-qhr7-859c-m2p7
• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
• https://nvd.nist.gov/vuln/detail/CVE-2026-102278
• https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b
• https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c
• https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db
• https://github.com/juliangruber/brace-expansion

CVE-2026-102278 · published 2026-09-29T23:45:17Z · modified 2026-09-30T00:00:04.402763332Z · JSON