{"uuid": "596549a6-0a9c-4aab-b3a0-3b54dfaf298e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102276", "type": "seen", "source": "https://gist.github.com/alon710/d827ad6e98a8cc50eabc41e492108cb6", "content": "# CVE-2026-102276: CVE-2026-102276: Denial of Service via Uncontrolled Recursion and Argument-List Exhaustion in brace-expansion\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102276\n\n## Summary\nCVE-2026-102276 is a high-severity Denial of Service (DoS) vulnerability impacting the 'brace-expansion' library, a popular Node.js utility designed to expand brace patterns into combinatorial lists. Due to uncontrolled recursion and argument-list stack exhaustion within the internal parseCommaParts function, remote attackers can trigger an unhandled RangeError that abruptly terminates the Node.js process.\n\n## TL;DR\nA denial-of-service vulnerability in brace-expansion allows unauthenticated remote attackers to crash Node.js applications by submitting maliciously nested or long comma-separated brace patterns, bypassing application-level limits.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-674\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.5 (High)\n- **EPSS Score**: 0.0035 (26.16th percentile)\n- **Impact Category**: Denial of Service (Process Termination)\n- **Exploit Status**: Proof-of-concept available\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- brace-expansion Node.js library\n- **brace-expansion**: < 1.1.19 (Fixed in: `1.1.19`)\n- **brace-expansion**: >= 2.0.0, < 2.1.5 (Fixed in: `2.1.5`)\n- **brace-expansion**: >= 3.0.0, < 3.0.7 (Fixed in: `3.0.7`)\n- **brace-expansion**: >= 4.0.0, < 5.0.10 (Fixed in: `5.0.10`)\n\n## Mitigation\n\n- Upgrade the brace-expansion library to patched security versions (1.1.19, 2.1.5, 3.0.7, or 5.0.10).\n- Use npm overrides or yarn resolutions to force upstream transitive libraries like minimatch to load the patched dependency version.\n- Incorporate input-validation logic to drop incoming parameters with excessive brace nesting levels (>100 nested characters) at the network border.\n\n**Remediation Steps:**\n1. Scan the project dependencies using `npm list brace-expansion` to identify vulnerable versions in use.\n2. Update the project package.json to the correct safe version matching your active major release version.\n3. Inject a dependency resolution override block within your package.json metadata.\n4. Run `npm install` or `yarn install` to update the lockfile structure and clear old transitive references.\n\n## References\n\n- [GitHub Security Advisory GHSA-6j4f-fj2g-mc7p](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n- [NVD Vulnerability Details: CVE-2026-102276](https://nvd.nist.gov/vuln/detail/CVE-2026-102276)\n- [CVE Record: CVE-2026-102276](https://www.cve.org/CVERecord?id=CVE-2026-102276)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102276) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T10:30:31.000000Z"}