CVE-2026-102278: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
expand_() recurses once per level of brace nesting. Deeply nested input exhausts the native stack and crashes the process.
This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the tail iterative (recursion on m.post, driven by how many groups are chained). Nesting depth drives a different recursion that the tail fix never touched, so the documented constant-stack-depth guarantee only ever covered chained input, not nested input.
It is also distinct from GHSA-6j4f-fj2g-mc7p, which fixed recursion in parseCommaParts(). Both payloads below still crash with that fix applied.
References
- github.com/advisories/GHSA-qhr7-859c-m2p7
- github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b
- github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c
- github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db
- github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
- nvd.nist.gov/vuln/detail/CVE-2026-102278
Code Behaviors & Features
Detect and mitigate CVE-2026-102278 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →