CVE-2026-102276: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
parseCommaParts() can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string.
This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made expand_() iterative and documented a constant-stack-depth guarantee, but parseCommaParts() was left recursive, so the guarantee only held for one of the two parsing paths.
References
- github.com/advisories/GHSA-6j4f-fj2g-mc7p
- github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc
- github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c
- github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc
- github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3
- github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p
- nvd.nist.gov/vuln/detail/CVE-2026-102276
Code Behaviors & Features
Detect and mitigate CVE-2026-102276 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →