brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
Priority LOW 39CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 14 fixed, 37 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00491 42nd percentileScored 2026-11-07
Fix Partial brace-expansion (juliangruber): 5.0.11, 3.0.8, 2.1.6 +1brace-expansion (npm): 5.0.11, 3.0.8, 2.1.6 +1Red Hat: 22 advisoriesRed Hat: 14 fixed, 37 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| juliangruber | brace-expansion | 4.0.0 to before 5.0.11; 3.0.0 to before 3.0.8; 2.0.0 to before 2.1.6; before 1.1.20 | 5.0.11, 3.0.8, 2.1.6, 1.1.20 | Patch available | CNA |
| — | brace-expansion (npm) | 4.0.0 to before 5.0.11 | 5.0.11 | Patch available | GHSA-qhr7-859c-m2p7 |
| — | brace-expansion (npm) | 3.0.0 to before 3.0.8 | 3.0.8 | Patch available | GHSA-qhr7-859c-m2p7 |
| — | brace-expansion (npm) | 2.0.0 to before 2.1.6 | 2.1.6 | Patch available | GHSA-qhr7-859c-m2p7 |
| — | brace-expansion (npm) | before 1.1.20 | 1.1.20 | Patch available | GHSA-qhr7-859c-m2p7 |
- brace-expansion Vendorjuliangruber Affected 4.0.0 to before 5.0.11; 3.0.0 to before 3.0.8; 2.0.0 to before 2.1.6; before 1.1.20 Fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 Patch available CNA
- brace-expansion (npm) Vendor— Affected 4.0.0 to before 5.0.11 Fixed in 5.0.11 Patch available GHSA-qhr7-859c-m2p7
- brace-expansion (npm) Vendor— Affected 3.0.0 to before 3.0.8 Fixed in 3.0.8 Patch available GHSA-qhr7-859c-m2p7
- brace-expansion (npm) Vendor— Affected 2.0.0 to before 2.1.6 Fixed in 2.1.6 Patch available GHSA-qhr7-859c-m2p7
- brace-expansion (npm) Vendor— Affected before 1.1.20 Fixed in 1.1.20 Patch available GHSA-qhr7-859c-m2p7
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:*:*:* | — | — | juliangruber |
- cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:*:*:* Versions — — ·juliangruber
Remediation
- Fix · CNA brace-expansion (juliangruber) Fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20
- Fix · GHSA-qhr7-859c-m2p7 brace-expansion (npm) Fixed in 5.0.11 Advisory →
- Fix · GHSA-qhr7-859c-m2p7 brace-expansion (npm) Fixed in 3.0.8 Advisory →
- Fix · GHSA-qhr7-859c-m2p7 brace-expansion (npm) Fixed in 2.1.6 Advisory →
- Fix · GHSA-qhr7-859c-m2p7 brace-expansion (npm) Fixed in 1.1.20 Advisory →
Red Hat 22 advisories
- RHSA-2026:95591 Released 2026-11-05 · Red Hat rating ImportantCluster Observability Operator - 1.5
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
- RHSA-2026:95360 Released 2026-11-04 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-storage-rhel9
- RHSA-2026:95081 Released 2026-11-04 · Red Hat rating ImportantCluster Observability Operator - 1.5
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
Show 19 more Red Hat advisories
- RHSA-2026:94612 Released 2026-11-03 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.2 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:94608 Released 2026-11-03 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.2 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:92378 Released 2026-10-29 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64::nodejs:24, nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le::nodejs:24, nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x::nodejs:24 +25
- RHSA-2026:92584 Released 2026-10-29 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:92578 Released 2026-10-29 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:92510 Released 2026-10-29 · Red Hat rating CriticalRHOAI 3.4.6 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:92376 Released 2026-10-29 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24, nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24, nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 +25
- RHSA-2026:92136 Released 2026-10-28 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:91967 Released 2026-10-28 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:89199 Released 2026-10-26 · Red Hat rating ImportantOpenShift Container Platform 4.22.20 security and extras update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-support-log-gather-rhel9-operator
- RHSA-2026:89656 Released 2026-10-26 · Red Hat rating ImportantOpenShift Container Platform 4.19.53 security and extras update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9, registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator
- RHSA-2026:89342 Released 2026-10-26 · Red Hat rating ImportantOpenShift Container Platform 4.20.44 security and extras update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-support-log-gather-rhel9-operator
- RHSA-2026:83703 Released 2026-10-20 · Red Hat rating ImportantOpenShift Container Platform 4.21.39 security and extras update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9 +6
- RHSA-2026:74168 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs26-1:26.10.0-0.3.hum1@aarch64, nodejs26-1:26.10.0-0.3.hum1@src, nodejs26-1:26.10.0-0.3.hum1@x86_64 +14
- RHSA-2026:74167 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs24-1:24.21.0-1.2.hum1@aarch64, nodejs24-1:24.21.0-1.2.hum1@src, nodejs24-1:24.21.0-1.2.hum1@x86_64 +16
- RHSA-2026:74161 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs22-1:22.23.3-2.3.2.2.hum1@aarch64, nodejs22-1:22.23.3-2.3.2.2.hum1@src, nodejs22-1:22.23.3-2.3.2.2.hum1@x86_64 +14
- RHSA-2026:73916 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs24-1:24.21.0-1.1.hum1@aarch64, nodejs24-1:24.21.0-1.1.hum1@src, nodejs24-1:24.21.0-1.1.hum1@x86_64 +16
- RHSA-2026:73914 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs22-1:22.23.3-2.3.2.1.hum1@aarch64, nodejs22-1:22.23.3-2.3.2.1.hum1@src, nodejs22-1:22.23.3-2.3.2.1.hum1@x86_64 +16
- RHSA-2026:73856 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs26-1:26.10.0-0.2.hum1@aarch64, nodejs26-1:26.10.0-0.2.hum1@src, nodejs26-1:26.10.0-0.2.hum1@x86_64 +16
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management On Premise | Affected | No fix yet |
| Exploit Intelligence | Affected | No fix yet |
| Migration Toolkit for Applications 8 | Affected | No fix yet |
| Migration Toolkit for Containers | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Developer Hub 1 | Affected | No fix yet |
| Red Hat Directory Server 11 | Affected | No fix planned: Will not fix |
| Red Hat Directory Server 12 | Affected | No fix planned: Will not fix |
| Red Hat Directory Server 13 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:95081, RHSA-2026:95591 |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:95360 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:91967, RHSA-2026:92136 |
| Red Hat Edge Manager 1.2 | Fixed | RHSA-2026:94608, RHSA-2026:94612 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:92376 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:92378 |
| Red Hat Hardened Images | Fixed | RHSA-2026:73856, RHSA-2026:73914, RHSA-2026:73916, RHSA-2026:74161, RHSA-2026:74167, RHSA-2026:74168 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:92510 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:89656 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:89342 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:83703 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:89199 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:92584 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:92578 |
Not affected: 27 products
- Cluster Observability Operator 1.5
- Cryostat 4 on RHEL 9
- OpenShift Lightspeed
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Data Grid 8
- Red Hat Discovery 2
- Red Hat Edge Manager 1.2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat Trusted Profile Analyzer
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-102278
- 2026-10-03 Alias added: GHSA-qhr7-859c-m2p7
- 2026-10-09 CVSS score changed · Red Hat
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-18 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:83703 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift Container Platform 4.21 · Red Hat
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.22 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:89342 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:89656 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:89199 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91967 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92136 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92378 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92376 · Red Hat
- 2026-10-30 Fix available: Red Hat Discovery 2, Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +1 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.18 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92578 · Red Hat
- 2026-11-03 Fix available: RHSA-2026:92584 · Red Hat
- 2026-11-03 Fix available: Red Hat Satellite 6.19 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94612 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94608 · Red Hat
- 2026-11-04 Fix available: Red Hat Edge Manager 1.2 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:95081 · Red Hat
- 2026-11-04 Fix available: Cluster Observability Operator 1.5 · Red Hat
- 2026-11-05 Fix available: Cryostat 4 on RHEL 9 · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95591 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95360 · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
Other 5
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
- https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b
- https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c
- https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db
- https://github.com/juliangruber/brace-expansion
More juliangruber vulnerabilities
- TI-2026-48532 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVSS 3.1HIGH 7.5
- TI-2025-05315 juliangruber brace-expansion index.js expand redos CVSS 4.0LOW 2.3
- TI-2021-17956 Insecure random number generation CVSS 3.1CRITICAL 9.1
- TI-2026-12072 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash CVSS 3.1HIGH 7.5
- TI-2026-11166 Uncontrolled resource consumption in juliangruber brace-expansion CVSS 4.0HIGH 7.7
- TI-2026-65311 brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion CVSS 3.1HIGH 7.5
Sources
- CVE-2026-102278 · CVE Program
- CVE-2026-102278 · NVD
- FIRST EPSS
- GHSA-qhr7-859c-m2p7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-102278 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences