CVE-2026-102276: brace-expansion Library DOS Vulnerability

CVE-2026-102276 Overview

CVE-2026-102276 is a denial-of-service vulnerability in the brace-expansion npm library, a widely used dependency for generating strings from brace patterns. Crafted brace patterns exhaust the Node.js native stack inside the parseCommaParts function, terminating the process before the library's max or maxLength guards can bound output. The flaw affects versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, and is classified under CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
A remote attacker can send a specially crafted brace pattern to any application that parses untrusted input through brace-expansion, causing a process-terminating denial of service on the Node.js runtime.

Affected Products

brace-expansion versions prior to 1.1.19
brace-expansion versions prior to 2.1.5 and 3.0.7
brace-expansion versions prior to 5.0.10

Discovery Timeline

2026-09-28 - CVE-2026-102276 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102276

Vulnerability Analysis

The brace-expansion library expands shell-style brace patterns such as {a,b,c} into arrays of strings. Parsing is performed by parseCommaParts, which walks each brace group and recursively processes the remainder of the string. Two independent code paths lead to native stack exhaustion.

The first is a recursive path: parseCommaParts calls itself once per brace group when handling post, so a long chain of comma-separated brace groups produces a deep call stack. The second is an argument-array path: the function uses push.apply(parts, subparts) to append every element of a large comma-part array as individual function arguments. When the array is sufficiently large, this exceeds the JavaScript engine's argument-count limit and crashes the V8 native stack.

Both paths execute during parsing, before the max and maxLength output bounds are enforced. This allows an attacker to trigger a crash without producing large output.

Root Cause

The root cause is uncontrolled recursion and unbounded argument spreading inside parseCommaParts. The parser did not iterate brace groups or chunk large arrays before delegating to Array.prototype.push.apply, exposing the native call stack to attacker-controlled pattern complexity.

Attack Vector

Any application that passes attacker-controlled strings to brace-expansion — directly or through transitive dependencies such as minimatch, glob, or CLI tooling — is exposed. A network attacker sends a single crafted pattern to an HTTP endpoint, message queue, configuration file parser, or any code path that resolves globs from user input, and the Node.js process terminates.

javascript

// Security patch: iterative parsing and safe array append
// Source: https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc

// Like `target.push(...items)` but doesn't overflow the stack
function pushAll(target, items) {
  for (var i = 0; i < items.length; i++) {
    target.push(items[i]);
  }
}

// Basically just str.split(","), but handling cases
// where we have nested braced sections, which should be
// treated as individual members, like {a,{b,c},d}
function parseCommaParts(str) {
  var parts = [];

  // Walk the brace groups iteratively. Recursing on `post` once per group let a
  // chain of them exhaust the stack - the parsing-side counterpart to
  // the `expand` overflow fixed for CVE-2026-14257, and not something `max` or
  // `maxLength` can bound, since it happens before expansion.
  var carry = '';
  // ...
}

The patch replaces recursion with iteration and swaps push.apply for the bounded pushAll helper, closing both stack-exhaustion paths.

Detection Methods for CVE-2026-102276

Indicators of Compromise

Unexpected Node.js process termination with RangeError: Maximum call stack size exceeded or SIGABRT crashes referencing parseCommaParts.
Application logs containing anomalously long strings with dense sequences of {, }, and , characters submitted to endpoints that resolve globs or file patterns.
Repeated worker or container restarts correlated with a single client or upstream source.

Detection Strategies

Inventory Node.js applications and identify direct or transitive dependencies on brace-expansion using npm ls brace-expansion or Software Composition Analysis tooling.
Audit code paths that pass untrusted input to minimatch, glob, micromatch, or any function ultimately calling expand() from brace-expansion.
Instrument web application firewalls to flag request payloads containing large counts of unbalanced or nested brace sequences.

Monitoring Recommendations

Alert on Node.js process crash rates and correlate with request logs to identify attacker source addresses.
Track memory and CPU spikes in short bursts followed by process restarts, a signature consistent with parser-driven DoS.
Enable dependency-drift monitoring so downgrades below the fixed versions are reported.

How to Mitigate CVE-2026-102276

Immediate Actions Required

Upgrade brace-expansion to 1.1.19, 2.1.5, 3.0.7, or 5.0.10 depending on the major version in use.
Refresh lockfiles and rebuild container images to eliminate cached vulnerable versions pulled through transitive dependencies.
Validate and length-limit any user-supplied strings before passing them to glob or pattern-matching libraries.

Patch Information

Fixes are available in brace-expansion versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10. The patches introduce an iterative parser and a pushAll helper that replaces Array.prototype.push.apply. See the GitHub Security Advisory GHSA-6j4f-fj2g-mc7p and the upstream commit 0bcbfc0 for the full change set.

Workarounds

Enforce strict input size limits (for example, reject strings longer than a few kilobytes) on any endpoint that reaches brace-expansion.
Reject or sanitize input containing excessive brace or comma density before pattern expansion.
Run Node.js workers under a supervisor with rate-limited restart policies to blunt repeated exploitation attempts.

bash

# Upgrade brace-expansion across all resolution ranges
npm audit fix
npm update brace-expansion

# Verify installed versions
npm ls brace-expansion

# Force resolution in package.json when pulled transitively
# "overrides": {
#   "brace-expansion": "^2.1.5"
# }