CVE-2026-102278: 
JavaScript vulnerability analysis and mitigation

CVE-2026-102278 is a denial-of-service vulnerability in the brace-expansion npm library caused by uncontrolled recursion when processing deeply nested brace groups. The expand_() function recurses once per nesting level at two sites — comma-member expansion and single-set re-wrapping — exhausting the native call stack and terminating the Node.js process before any output limits can apply. Affected versions include all releases prior to 1.1.20 (1.x branch), 2.1.6 (2.x branch), 3.0.8 (3.x branch), and 5.0.11 (5.x branch). The vulnerability was published on September 28, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat).

The root cause is uncontrolled recursion (CWE-674) leading to uncontrolled resource consumption (CWE-400) in the internal expand_() function. Two distinct recursion sites are affected: (1) Comma members — each alternative of a brace set triggers a recursive call, so nesting a set inside every alternative recurses once per level (e.g., '{a,'.repeat(4000) + 'z' + '}'.repeat(4000) crashes at ~3,907 levels, ~15.6 KB of input); (2) Single set — a brace set whose body parses to a single part is re-wrapped via a recursive call (e.g., '{'.repeat(3200) + 'a,b' + '}'.repeat(3200) crashes at ~3,125 levels, ~6.25 KB of input). Critically, the existing max and maxLength output bounds cannot prevent these crashes because the stack exhaustion occurs during recursive sub-expansion before any output is produced. This vulnerability is distinct from the prior tail-recursion fix in CVE-2026-14257, which only made chained group expansion iterative and left nesting-depth recursion unbounded (GitHub Advisory, Patch Commit).

Successful exploitation results in a RangeError: Maximum call stack size exceeded that, if uncaught, terminates the Node.js process entirely. The impact is limited to availability — there is no code execution, no data exposure, and no integrity impact. Any server-side application that passes untrusted user input to expand() directly, or indirectly through libraries such as minimatch or glob, is exposed to remote unauthenticated denial of service with as little as ~6 KB of crafted input (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the time of reporting (GitHub Advisory). The vulnerability is network-exploitable with no authentication or user interaction required, and NVD's SSVC assessment marks it as automatable. The EPSS score is approximately 0.35%, indicating a low (but non-negligible) probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat).

1. Identify target: Locate a Node.js application or service that accepts user-controlled string input and passes it to brace-expansion's expand() function — either directly or via dependent libraries such as minimatch, glob, or similar pattern-matching utilities.
2. Craft payload: Construct a deeply nested brace pattern. The cheapest known payload uses the single-set shape: '{'.repeat(3200) + 'a,b' + '}'.repeat(3200) (~6.25 KB). The comma-member shape also works: '{a,'.repeat(4000) + 'z' + '}'.repeat(4000) (~15.6 KB).
3. Submit payload: Send the crafted pattern as input to the vulnerable endpoint (e.g., a search field, file glob parameter, or API parameter that accepts pattern strings).
4. Trigger stack exhaustion: The expand_() function recurses once per nesting level, exhausting the native call stack before any output bounds apply, resulting in an uncaught RangeError: Maximum call stack size exceeded.
5. Achieve DoS: If the application does not catch the RangeError, the Node.js process terminates, causing a denial of service for all users of that service (GitHub Advisory, Patch Commit).

• Logs: Node.js process crash logs or stderr output containing RangeError: Maximum call stack size exceeded with a stack trace referencing expand_, expand, or brace-expansion module paths.
• Application Logs: Sudden, unexplained process restarts or crash reports from a Node.js application, particularly correlated with incoming requests containing strings with large numbers of {, }, or , characters.
• Network: Inbound HTTP requests or other network input containing highly repetitive sequences of { and } characters (e.g., thousands of consecutive opening or closing braces) in user-supplied parameters such as search queries, glob patterns, or file path inputs.
• Process: Unexpected termination of Node.js worker processes or application containers, especially if process managers (e.g., PM2, systemd) log repeated restarts in a short time window (GitHub Advisory).

Upgrade brace-expansion to one of the patched versions: 1.1.20 (1.x branch), 2.1.6 (2.x branch), 3.0.8 (3.x branch), or 5.0.11 (5.x branch). The fix introduces a maxDepth bound (default EXPANSION_MAX_DEPTH = 1000) threaded through expand_(), causing groups nested beyond the limit to be returned literally rather than expanded, preventing stack exhaustion without throwing exceptions. As a temporary workaround if immediate patching is not possible, implement input validation to reject or truncate patterns containing deeply nested brace groups before they reach the expand() function (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability with high severity in their Bugzilla system, with over 190 engineers and teams listed as CC recipients, indicating broad impact across Red Hat's product portfolio (Red Hat Bugzilla). Microsoft has also published an advisory for this CVE, reflecting its downstream impact on products that bundle Node.js or npm packages (Microsoft MSRC). The OpenSUSE security announce mailing list and AWS solutions teams have also issued related advisories, indicating broad ecosystem awareness and patching activity.