{"uuid": "bc56d45d-1838-4fc2-bb45-52865ac84436", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102278", "type": "seen", "source": "https://gist.github.com/alon710/0d56f2b70b5c40c034bfd6d3d8f34a39", "content": "# CVE-2026-102278: CVE-2026-102278: Stack-Based Denial of Service via Uncontrolled Recursion in brace-expansion\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102278\n\n## Summary\nA stack-based Denial of Service (DoS) vulnerability via uncontrolled recursion in the brace-expansion library prior to versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11 allows unauthenticated remote attackers to trigger native stack exhaustion, terminating the Node.js process via a crafted payload containing deeply nested brace groups.\n\n## TL;DR\nUncontrolled recursion in nested brace groups allows unauthenticated attackers to crash the Node.js process via a stack overflow using compact (~6KB) inputs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS**: 7.5 (High)\n- **EPSS**: 0.0035 (26th percentile)\n- **Impact**: Denial of Service (Process Termination)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications processing untrusted shell-like patterns or glob vectors via brace-expansion.\n- Libraries utilizing brace-expansion transitively, such as older versions of minimatch or glob parsers.\n- **brace-expansion**: < 1.1.20 (Fixed in: `1.1.20`)\n- **brace-expansion**: >= 2.0.0, < 2.1.6 (Fixed in: `2.1.6`)\n- **brace-expansion**: >= 3.0.0, < 3.0.8 (Fixed in: `3.0.8`)\n- **brace-expansion**: >= 4.0.0, < 5.0.11 (Fixed in: `5.0.11`)\n\n## Mitigation\n\n- Upgrade dependency to patched versions across all active branches.\n- Sanitize and restrict input pattern complexity at application entry points.\n- Employ process managers (e.g., PM2) to ensure auto-restart capability upon crash events.\n\n**Remediation Steps:**\n1. Identify vulnerable versions of brace-expansion using 'npm ls brace-expansion' or Software Composition Analysis.\n2. Force update of deep dependencies using package manager resolutions or overrides if transitive.\n3. In npm projects using version 5, execute: npm install brace-expansion@5.0.11\n4. Verify the application does not crash when supplied with deeply nested brace patterns.\n\n## References\n\n- [Official GitHub Advisory GHSA-qhr7-859c-m2p7](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [NVD CVE-2026-102278 Reference](https://nvd.nist.gov/vuln/detail/CVE-2026-102278)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102278) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T09:30:30.000000Z"}