CVE-2026-102278

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 1.1.20 brace-expansion versions prior to 2.1.6 brace-expansion versions prior to 3.0.8 brace-expansion versions prior to 5.0.11

Description Deeply nested brace groups supplied as an untrusted pattern can cause the expand () and expand() functions to perform uncontrolled recursion at comma-member and single-set expansion sites. This behavior exhausts the native stack before output limits are applied, leading to a process-terminating denial of service in the Node.js process.

Recommendations Update to version 1.1.20 or later. Update to version 2.1.6 or later. Update to version 3.0.8 or later. Update to version 5.0.11 or later.