brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
Priority LOW 39CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 38 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00455 39th percentileScored 2026-11-07
Fix Partial brace-expansion (juliangruber): 5.0.10, 3.0.7, 2.1.5 +1brace-expansion (npm): 5.0.10, 3.0.7, 2.1.5 +1Red Hat: 16 advisoriesRed Hat: 10 fixed, 38 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| juliangruber | brace-expansion | 4.0.0 to before 5.0.10; 3.0.0 to before 3.0.7; 2.0.0 to before 2.1.5; before 1.1.19 | 5.0.10, 3.0.7, 2.1.5, 1.1.19 | Patch available | CNA |
| — | brace-expansion (npm) | 4.0.0 to before 5.0.10 | 5.0.10 | Patch available | GHSA-6j4f-fj2g-mc7p |
| — | brace-expansion (npm) | 3.0.0 to before 3.0.7 | 3.0.7 | Patch available | GHSA-6j4f-fj2g-mc7p |
| — | brace-expansion (npm) | 2.0.0 to before 2.1.5 | 2.1.5 | Patch available | GHSA-6j4f-fj2g-mc7p |
| — | brace-expansion (npm) | before 1.1.19 | 1.1.19 | Patch available | GHSA-6j4f-fj2g-mc7p |
- brace-expansion Vendorjuliangruber Affected 4.0.0 to before 5.0.10; 3.0.0 to before 3.0.7; 2.0.0 to before 2.1.5; before 1.1.19 Fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 Patch available CNA
- brace-expansion (npm) Vendor— Affected 4.0.0 to before 5.0.10 Fixed in 5.0.10 Patch available GHSA-6j4f-fj2g-mc7p
- brace-expansion (npm) Vendor— Affected 3.0.0 to before 3.0.7 Fixed in 3.0.7 Patch available GHSA-6j4f-fj2g-mc7p
- brace-expansion (npm) Vendor— Affected 2.0.0 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-6j4f-fj2g-mc7p
- brace-expansion (npm) Vendor— Affected before 1.1.19 Fixed in 1.1.19 Patch available GHSA-6j4f-fj2g-mc7p
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:*:*:* | — | — | juliangruber |
- cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:*:*:* Versions — — ·juliangruber
Remediation
- Fix · CNA brace-expansion (juliangruber) Fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19
- Fix · GHSA-6j4f-fj2g-mc7p brace-expansion (npm) Fixed in 5.0.10 Advisory →
- Fix · GHSA-6j4f-fj2g-mc7p brace-expansion (npm) Fixed in 3.0.7 Advisory →
- Fix · GHSA-6j4f-fj2g-mc7p brace-expansion (npm) Fixed in 2.1.5 Advisory →
- Fix · GHSA-6j4f-fj2g-mc7p brace-expansion (npm) Fixed in 1.1.19 Advisory →
Red Hat 16 advisories
- RHSA-2026:95591 Released 2026-11-05 · Red Hat rating ImportantCluster Observability Operator - 1.5
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
- RHSA-2026:95360 Released 2026-11-04 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-storage-rhel9
- RHSA-2026:95081 Released 2026-11-04 · Red Hat rating ImportantCluster Observability Operator - 1.5
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
Show 13 more Red Hat advisories
- RHSA-2026:94612 Released 2026-11-03 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.2 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:94608 Released 2026-11-03 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.2 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:92378 Released 2026-10-29 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64::nodejs:24, nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le::nodejs:24, nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x::nodejs:24 +25
- RHSA-2026:92584 Released 2026-10-29 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:92578 Released 2026-10-29 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:92510 Released 2026-10-29 · Red Hat rating CriticalRHOAI 3.4.6 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:92376 Released 2026-10-29 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24, nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24, nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 +25
- RHSA-2026:92136 Released 2026-10-28 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:91967 Released 2026-10-28 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:84657 Released 2026-10-19 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs26-26.11.1-0.4.hum1@aarch64, nodejs26-26.11.1-0.4.hum1@s390x, nodejs26-26.11.1-0.4.hum1@src +25
- RHSA-2026:74168 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs26-1:26.10.0-0.3.hum1@aarch64, nodejs26-1:26.10.0-0.3.hum1@src, nodejs26-1:26.10.0-0.3.hum1@x86_64 +14
- RHSA-2026:74167 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs24-1:24.21.0-1.2.hum1@aarch64, nodejs24-1:24.21.0-1.2.hum1@src, nodejs24-1:24.21.0-1.2.hum1@x86_64 +16
- RHSA-2026:74161 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs22-1:22.23.3-2.3.2.2.hum1@aarch64, nodejs22-1:22.23.3-2.3.2.2.hum1@src, nodejs22-1:22.23.3-2.3.2.2.hum1@x86_64 +14
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management On Premise | Affected | No fix yet |
| Exploit Intelligence | Affected | No fix yet |
| Migration Toolkit for Applications 8 | Affected | No fix yet |
| Migration Toolkit for Containers | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Developer Hub 1 | Affected | No fix yet |
| Red Hat Directory Server 11 | Affected | No fix planned: Will not fix |
| Red Hat Directory Server 12 | Affected | No fix planned: Will not fix |
| Red Hat Directory Server 13 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:95081, RHSA-2026:95591 |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:95360 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:91967, RHSA-2026:92136 |
| Red Hat Edge Manager 1.2 | Fixed | RHSA-2026:94608, RHSA-2026:94612 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:92376 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:92378 |
| Red Hat Hardened Images | Fixed | RHSA-2026:74161, RHSA-2026:74167, RHSA-2026:74168, RHSA-2026:84657 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:92510 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:92584 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:92578 |
Not affected: 25 products
- Cluster Observability Operator 1.5
- Cryostat 4 on RHEL 9
- Gatekeeper 3
- Migration Toolkit for Applications 8
- OpenShift Lightspeed
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Discovery 2
- Red Hat Edge Manager 1.2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift GitOps
- Red Hat Trusted Profile Analyzer
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-102276
- 2026-10-03 Alias added: GHSA-6j4f-fj2g-mc7p
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-15 Affected versions changed · Red Hat
- 2026-10-18 Affected versions changed · Red Hat
- 2026-10-19 Fix available: RHSA-2026:84657 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-22 Affected versions changed · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91967 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92136 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92378 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92376 · Red Hat
- 2026-10-30 Fix available: Red Hat Discovery 2, Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +1 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.18, Red Hat Satellite 6.19 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92578 · Red Hat
- 2026-11-03 Fix available: RHSA-2026:92584 · Red Hat
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94612 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94608 · Red Hat
- 2026-11-04 Fix available: Red Hat Edge Manager 1.2 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:95081 · Red Hat
- 2026-11-04 Fix available: Cluster Observability Operator 1.5 · Red Hat
- 2026-11-05 Fix available: Cryostat 4 on RHEL 9 · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95591 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95360 · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
Other 6
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p
- https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc
- https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c
- https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc
- https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3
- https://github.com/juliangruber/brace-expansion
More juliangruber vulnerabilities
- TI-2026-48532 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVSS 3.1HIGH 7.5
- TI-2025-05315 juliangruber brace-expansion index.js expand redos CVSS 4.0LOW 2.3
- TI-2021-17956 Insecure random number generation CVSS 3.1CRITICAL 9.1
- TI-2026-12072 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash CVSS 3.1HIGH 7.5
- TI-2026-11166 Uncontrolled resource consumption in juliangruber brace-expansion CVSS 4.0HIGH 7.7
- TI-2026-65313 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion CVSS 3.1HIGH 7.5
Sources
- CVE-2026-102276 · CVE Program
- CVE-2026-102276 · NVD
- FIRST EPSS
- GHSA-6j4f-fj2g-mc7p · GitHub Advisory Database · CC BY 4.0
- CVE-2026-102276 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences