CVE-2026-102276: 
JavaScript vulnerability analysis and mitigation

CVE-2026-102276 is a denial-of-service vulnerability in the brace-expansion npm library caused by uncontrolled recursion and argument-array stack exhaustion in the parseCommaParts() function. It affects all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10 (including the 4.x branch before 5.0.10). The vulnerability was reported by researcher baeseungwon1010, with the GitHub Security Advisory (GHSA-6j4f-fj2g-mc7p) published on September 14, 2026, and the CVE assigned on September 28, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption), CWE-674 (Uncontrolled Recursion), and CWE-770 (Allocation of Resources Without Limits or Throttling). There are two distinct attack vectors, both reachable from a single untrusted pattern string passed to expand(): Vector 1 — parseCommaParts() recursed on the post remainder once per brace group, so a pattern like '{' + '{a},'.repeat(7000) + 'b}' (~29 KB on Node 24) triggers a RangeError: Maximum call stack size exceeded before any output limits (max/maxLength) can apply, since the crash occurs during parsing. Vector 2 — push.apply(target, items) places one argument per array element on the native stack, so a pattern like '{{x},' + 'a,'.repeat(125000) + 'b}' (~249 KB) overflows the stack at a recursion depth of exactly one, requiring no deep recursion at all. Critically, neither max nor maxLength guards can prevent either crash because both occur during parsing before any expansion takes place (GitHub Advisory, Patch Commit).

Successful exploitation causes a process-terminating denial of service: an uncaught RangeError in Node.js terminates the entire process, taking down any server or service that passes untrusted input to expand(). This affects any application using brace-expansion directly or indirectly through dependent libraries such as minimatch or glob — notably, minimatch's own MAX_PATTERN_LENGTH cap of 65,536 characters does not prevent Vector 1, as the overflow threshold (~29 KB) sits well below it. The impact is availability-only; there is no code execution, data exposure, or integrity risk (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is network-exploitable with no authentication or user interaction required, and NVD's SSVC assessment marks it as automatable. The EPSS score is approximately 0.35%, indicating a low (but non-negligible) probability of exploitation in the near term. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

1. Identify target: Locate a Node.js application or service that accepts user-controlled glob patterns or brace-expansion strings and passes them to expand() — either directly via brace-expansion, or indirectly through minimatch or glob.
2. Craft Vector 1 payload (recursion): Construct a pattern with many comma-separated brace groups nested inside an outer brace set, e.g., '{' + '{a},'.repeat(7000) + 'b}' (~29 KB). This triggers unbounded recursion in parseCommaParts() at approximately 7,300 repetitions on Node 24.
3. Craft Vector 2 payload (push.apply): Alternatively, construct a pattern with a single brace group containing a very large comma-separated list, e.g., '{{x},' + 'a,'.repeat(125000) + 'b}' (~249 KB). This overflows the stack via push.apply at a recursion depth of one.
4. Submit payload: Send the crafted pattern to the target application via any input channel that reaches expand() — HTTP request parameters, file upload names, API fields, etc.
5. Achieve DoS: The Node.js process throws an uncaught RangeError: Maximum call stack size exceeded and terminates, causing a service outage (GitHub Advisory, Patch Commit).

• Logs: Node.js process crash logs or stderr output containing RangeError: Maximum call stack size exceeded with a stack trace referencing parseCommaParts in brace-expansion/index.js; application or web server logs showing unexpected process restarts or 502/503 errors coinciding with specific requests.
• Network: Inbound HTTP requests (or other protocol messages) containing unusually large brace-pattern strings (e.g., 25–250 KB payloads with repetitive {...}, structures) in query parameters, request bodies, or headers that are passed to glob/pattern-matching logic.
• Process: Sudden, unexplained Node.js process termination (exit code 1) without a graceful shutdown signal; process manager (PM2, systemd, etc.) logs showing repeated automatic restarts of the Node.js service.

Upgrade brace-expansion to the patched versions: 1.1.19 (1.x branch), 2.1.5 (2.x branch), 3.0.7 (3.x branch), or 5.0.10 (4.x/5.x branch). The fix rewrites parseCommaParts() as an iterative loop and replaces all push.apply() calls with an element-by-element pushAll() helper, eliminating both attack vectors. If an immediate upgrade is not possible, consider validating or rejecting untrusted brace-pattern strings before passing them to expand() — though note that neither the max nor maxLength options provide protection against these specific vectors. Audit transitive dependencies (e.g., minimatch, glob) that may pull in a vulnerable version of brace-expansion (GitHub Advisory, Red Hat CVE).

The vulnerability was credited to reporter baeseungwon1010, who provided a working proof of concept and a proposed patch; Vector 2 (the push.apply path) was independently identified by the maintainer during verification. The advisory notes this is the parsing-side counterpart to CVE-2026-14257 (GHSA-mh99-v99m-4gvg), which had previously fixed the expand_() function but left parseCommaParts() recursive. Red Hat has tracked the issue via Bugzilla and published a CVE advisory. No significant broader media coverage or social media discussion has been identified at this time (GitHub Advisory, Red Hat CVE).