7.5

CVE-2026-102278: juliangruber brace-expansion Uncontrolled Resource Consumption

CVSS: 7.5v3.1HighDeferred
AliasesRHSA-2026:73856RHSA-2026:73914RHSA-2026:73916
Published 28-09-2026Last modified 01-10-2026
Open JSON

Vulnerability summary

CVE-2026-102278 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in juliangruber brace-expansion. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.2% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.35%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 2
OPENSUSE-SU-2026:11967-1OPENSUSE-SU-2026:22111-1RHSA-2026:74161RHSA-2026:74167RHSA-2026:74168

Timeline

  1. 28-09-2026
    PublishedVulnerability first disclosed.
  2. 01-10-2026
    Last modifiedVulnerability information updated.

Description

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

29-09-202620-10-2026
EPSS score
0.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard111 products
  • actions-runner< 2.337.0-r2
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.12< 3.12.12.1-r3
  • authentik-2025.12< 2025.12.6-r16
Redhat27 products
  • nodejs22< 0:22.23.3-2.3.2.1.hum1
  • nodejs22-bin< 0:22.23.3-2.3.2.1.hum1
  • nodejs22-devel< 0:22.23.3-2.3.2.1.hum1
  • nodejs22-docs< 0:22.23.3-2.3.2.1.hum1
  • nodejs22-full-i18n< 0:22.23.3-2.3.2.1.hum1
Wolfi15 products
  • jupyter-base-notebook< 7.6.3-r2
  • lerna< 10.0.1-r6
  • nextcloud-server-33< 33.0.9-r1
  • npm-12< 12.2.0-r1
  • opensearch-dashboards-3< 3.8.0-r9
Debian1 product
  • node-brace-expansionAll versions (No fix recorded) | < 2.1.7+~1.1.2-1
Juliangruber1 product
  • brace-expansion≥ 4.0.0, < 5.0.11 | ≥ 3.0.0, < 3.0.8 | ≥ 2.0.0, < 2.1.6 | < 1.1.20
Npm1 product
  • brace-expansion≥ 4.0.0, < 5.0.11 | ≥ 3.0.0, < 3.0.8 | ≥ 2.0.0, < 2.1.6 | < 1.1.20
Ubuntu1 product
  • node-brace-expansionAll versions (No fix recorded)

7 vendors · 157 products

References

20 links
Show all 20 references