Every CVE Search/ Get API key

CVE-2026-102278

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

7.5 HighFix available

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.49%Up 0.1 points since Sep 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Record
CVE-2026-102278
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
EUVDEUVD-2026-88555 7.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Record
EUVD-2026-88555
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qhr7-859c-m2p7 7.5

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Summary

expand_() recurses once per level of brace nesting. Deeply nested input exhausts the native stack and crashes the process.

This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the tail iterative (recursion on m.post, driven by how many groups are chained). Nesting depth drives a different recursion that the tail fix never touched, so the documented constant-stack-depth guarantee only ever covered chained input, not nested input.

It is also distinct from GHSA-6j4f-fj2g-mc7p, which fixed recursion in parseCommaParts(). Both payloads below still crash with that fix applied.

Two recursion sites

Comma members. Each alternative of a brace set is expanded by a recursive call, so nesting a set inside every alternative recurses once per level:

expand('{a,'.repeat(4000) + 'z' + '}'.repeat(4000))
// RangeError: Maximum call stack size exceeded

Crashes at depth 3,907 - about 15.6 KB of input.

Single set. A brace set whose body parses to a single part is expanded by a recursive call before being re-wrapped (x{{a,b}}y -> x{a}y x{b}y), which recurses once per nesting level:

expand('{'.repeat(3200) + 'a,b' + '}'.repeat(3200))
// RangeError: Maximum call stack size exceeded

Crashes at depth 3,125 - about 6.25 KB of input. This is the cheapest stack-exhaustion payload known against this package: roughly a quarter the input of GHSA-6j4f-fj2g-mc7p (29 KB), and about a tenth of minimatch's MAX_PATTERN_LENGTH (65,536).

Why max and maxLength do not help

Both crashes happen while recursing into sub-expansions, before the result set grows. The payloads produce almost no output - the single-set case yields 2 results - so neither bound is ever the limiter. expand(payload, { max: 1, maxLength: 1 }) still overflows.

Impact

Any application passing an untrusted string to expand(), directly or through minimatch / glob as a user-supplied glob pattern, can be crashed. In Node a RangeError the application does not catch terminates the process, so a server globbing user input is exposed to remote unauthenticated denial of service.

Availability only. No code execution, no data exposure.

Affected versions

Verified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, at near-identical depths on every line (single set: 3,125 on all four; comma members: 3,907-4,102). Not a regression from any recent fix - the gap predates them.

Patch

A maxDepth bound (default EXPANSION_MAX_DEPTH) is threaded through expand_(). Past the cap a group is treated as non-expanding and returned literally, which is how the parser already handles a group that cannot expand. This matches the existing max / maxLength caps, which truncate rather than throw, so expand() continues never to throw on any input.

The default sits far above any realistic nesting depth and well below the crash threshold.

Record
GHSA-qhr7-859c-m2p7
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
NVD 7.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Record
CVE-2026-102278
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
OSV 7.5

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Record
CVE-2026-102278
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
OSVDEBIAN-CVE-2026-102278 7.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Record
DEBIAN-CVE-2026-102278
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 40 moreShow less
OSVGHSA-qhr7-859c-m2p7 7.5

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Summary

expand_() recurses once per level of brace nesting. Deeply nested input exhausts the native stack and crashes the process.

This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the tail iterative (recursion on m.post, driven by how many groups are chained). Nesting depth drives a different recursion that the tail fix never touched, so the documented constant-stack-depth guarantee only ever covered chained input, not nested input.

It is also distinct from GHSA-6j4f-fj2g-mc7p, which fixed recursion in parseCommaParts(). Both payloads below still crash with that fix applied.

Two recursion sites

Comma members. Each alternative of a brace set is expanded by a recursive call, so nesting a set inside every alternative recurses once per level:

expand('{a,'.repeat(4000) + 'z' + '}'.repeat(4000))
// RangeError: Maximum call stack size exceeded

Crashes at depth 3,907 - about 15.6 KB of input.

Single set. A brace set whose body parses to a single part is expanded by a recursive call before being re-wrapped (x{{a,b}}y -> x{a}y x{b}y), which recurses once per nesting level:

expand('{'.repeat(3200) + 'a,b' + '}'.repeat(3200))
// RangeError: Maximum call stack size exceeded

Crashes at depth 3,125 - about 6.25 KB of input. This is the cheapest stack-exhaustion payload known against this package: roughly a quarter the input of GHSA-6j4f-fj2g-mc7p (29 KB), and about a tenth of minimatch's MAX_PATTERN_LENGTH (65,536).

Why max and maxLength do not help

Both crashes happen while recursing into sub-expansions, before the result set grows. The payloads produce almost no output - the single-set case yields 2 results - so neither bound is ever the limiter. expand(payload, { max: 1, maxLength: 1 }) still overflows.

Impact

Any application passing an untrusted string to expand(), directly or through minimatch / glob as a user-supplied glob pattern, can be crashed. In Node a RangeError the application does not catch terminates the process, so a server globbing user input is exposed to remote unauthenticated denial of service.

Availability only. No code execution, no data exposure.

Affected versions

Verified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, at near-identical depths on every line (single set: 3,125 on all four; comma members: 3,907-4,102). Not a regression from any recent fix - the gap predates them.

Patch

A maxDepth bound (default EXPANSION_MAX_DEPTH) is threaded through expand_(). Past the cap a group is treated as non-expanding and returned literally, which is how the parser already handles a group that cannot expand. This matches the existing max / maxLength caps, which truncate rather than throw, so expand() continues never to throw on any input.

The default sits far above any realistic nesting depth and well below the crash threshold.

Record
GHSA-qhr7-859c-m2p7
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
OSVRHSA-2026:73856 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:73856
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:73914 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:73914
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:73916 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:73916
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:74161 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:74161
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:74167 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:74167
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:74168 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:74168
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:92376 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92376
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:92378 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92378
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-102278 7.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Record
UBUNTU-CVE-2026-102278
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:92376 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92376
Updated
2026-11-02
OSVALSA-2026:92378 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92378
Updated
2026-11-02
OSVAZL-105078 No score

CVE-2026-102278 affecting package js-jquery 3.5.0-4

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Record
AZL-105078
Updated
2026-11-05
OSVAZL-105092 No score

CVE-2026-102278 affecting package nodejs-nodemon 2.0.3-5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Record
AZL-105092
Updated
2026-11-05
OSVAZL-105242 No score

CVE-2026-102278 affecting package python-tensorboard 2.16.2-6

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Record
AZL-105242
Updated
2026-11-02
OSVCLSA-2026-1790862926 No score

TuxCare security update for brace-expansion (2 CVEs)

TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 4.0.1-tuxcare.2.

Record
CLSA-2026-1790862926
Updated
2026-11-02
OSVCLSA-2026-1790869539 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.0.2-tuxcare.3.

Record
CLSA-2026-1790869539
Updated
2026-11-02
OSVCLSA-2026-1790876611 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.3.

Record
CLSA-2026-1790876611
Updated
2026-11-02
OSVCLSA-2026-1790887113 No score

TuxCare security update for brace-expansion (3 CVEs)

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 2.0.1-tuxcare.4.

Record
CLSA-2026-1790887113
Updated
2026-11-02
OSVCLSA-2026-1790888294 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.16-tuxcare.3.

Record
CLSA-2026-1790888294
Updated
2026-11-02
OSVCLSA-2026-1790937659 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.15-tuxcare.3.

Record
CLSA-2026-1790937659
Updated
2026-11-02
OSVCLSA-2026-1790968271 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.14-tuxcare.3.

Record
CLSA-2026-1790968271
Updated
2026-11-02
OSVCLSA-2026-1791226763 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.10-tuxcare.1.

Record
CLSA-2026-1791226763
Updated
2026-11-02
OSVCLSA-2026-1791278791 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.9-tuxcare.2.

Record
CLSA-2026-1791278791
Updated
2026-11-02
OSVCLSA-2026-1791282853 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.8-tuxcare.3.

Record
CLSA-2026-1791282853
Updated
2026-11-02
OSVCLSA-2026-1791282927 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.4-tuxcare.3.

Record
CLSA-2026-1791282927
Updated
2026-11-02
OSVCLSA-2026-1791626852 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.3.

Record
CLSA-2026-1791626852
Updated
2026-11-02
OSVCLSA-2026-1791627005 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.2-tuxcare.5.

Record
CLSA-2026-1791627005
Updated
2026-11-02
OSVCLSA-2026-1791627107 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.3-tuxcare.4.

Record
CLSA-2026-1791627107
Updated
2026-11-02
OSVCLSA-2026-1791798665 No score

TuxCare security update for brace-expansion (6 CVEs)

TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.5-tuxcare.2.

Record
CLSA-2026-1791798665
Updated
2026-11-02
OSVCLSA-2026-1791806331 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 5.0.4-tuxcare.3.

Record
CLSA-2026-1791806331
Updated
2026-11-02
OSVCLSA-2026-1792233030 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.12-tuxcare.5.

Record
CLSA-2026-1792233030
Updated
2026-11-02
OSVCLSA-2026-1792448853 No score

TuxCare security update for brace-expansion (6 CVEs)

TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.6-tuxcare.1.

Record
CLSA-2026-1792448853
Updated
2026-11-02
OSVCLSA-2026-1792453589 No score

TuxCare security update for brace-expansion (7 CVEs)

TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.3-tuxcare.1.

Record
CLSA-2026-1792453589
Updated
2026-11-02
OSVCLSA-2026-1792479350 No score

TuxCare security update for brace-expansion (7 CVEs)

TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.2-tuxcare.1.

Record
CLSA-2026-1792479350
Updated
2026-11-02
OSVCLSA-2026-1793102029 No score

TuxCare security update for brace-expansion (5 CVEs)

TuxCare rebuilt brace-expansion to address 5 CVEs. Fixed in 1.1.3-tuxcare.2.

Record
CLSA-2026-1793102029
Updated
2026-11-02
OSVCLSA-2026-1793180819 No score

TuxCare security update for brace-expansion (2 CVEs)

TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.

Record
CLSA-2026-1793180819
Updated
2026-11-02
OSVopenSUSE-SU-2026:11967-1 No score

pi-coding-agent-1.0.0-1.1 on GA media

These are all security issues fixed in the pi-coding-agent-1.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11967-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22111-1 No score

Security update for pi-coding-agent

This update for pi-coding-agent fixes the following issues:

Changes in pi-coding-agent:

  • Update to version 1.0.4 (1.0.3 was superseded the same day and never submitted):

    • BREAKING: provider azure-openai-responses renamed to azure, now also serving Azure Foundry Chat Completions (azure/deepseek-v4-pro first). Rename the provider key in auth.json (or run /login again), models.json and settings.json (defaultProvider, enabledModels and modelThinkingLevels); sessions on the old provider fall back and lose prompt cache. AZURE_OPENAI_* env vars unchanged
    • --tools and --exclude-tools take *-patterns and --no-mcp disables MCP for one run; --tools keeps MCP tools unless an entry starts with mcp__
    • Codemode read() on image files yields an image block image() shows, and image() also saves each image to a temp file for later turns
    • Fix fenced-code highlighting past the first line, MCP OAuth native-client registration, MCP shutdown racing a connecting server, Bedrock stalled-stream retries and frozen codemode built-ins, plus ChatGPT-login, EIO-on-closed-terminal and output-file-permission fixes
    • Many more fixes and improvements; see upstream's release notes for the full list

  • Refresh the vendored node_modules 1.0.2 -> 1.0.4: the ten @earendil-works packages move to 1.0.4; nanoid, postcss and vite move too but are dev-only and not shipped. Still 119 shipped modules and the licence union is unchanged

    • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it
    • CVE-2026-102277 (boo#1283392) and CVE-2026-102278 (boo#1283412): brace-expansion is 5.0.12, at the 5.0.12 and above the 5.0.11 fix floors, so the package is not affected by them

  • Update to version 1.0.2: patch releases on the 1.0 API, with no breaking changes

    • models.json takes samplingParamsByThinkingLevel next to the existing samplingParams, so an OpenAI-compatible model can set temperature, top_p and the like separately for off, minimal, low, medium, high, xhigh and max. Model defaults, the effective level's override and the request are merged per key, modelOverrides merges per level, and the levels are pi's own, not the provider's thinkingLevelMap values. Only openai-completions, openai-responses and azure-openai-responses apply them
    • MCP servers can be enabled, disabled or re-scoped per project from a .pi/mcp.json entry without a command or url, and /mcp toggles a user-level server for the current project
    • oauth.clientRegistration: "cimd" identifies pi by its Client ID Metadata Document instead of dynamic client registration
    • pi.registerToolRenderer() picks how calls to a tool that is not registered yet are drawn, such as MCP tools in a resumed session
    • Cloudflare's Clef and Clef Flash classifier models are usable from codemode scripts and extensions
    • A codemode script printing in a loop now fails at 16 Mi characters or 100000 items instead of running pi out of memory
    • MCP tool calls in resumed sessions and HTML exports no longer render fully expanded until their server connects
    • JPEG, GIF and WebP images that extensions draw through Image now appear in Kitty, Ghostty, WezTerm and Warp, and fullscreen Kitty images no longer collapse to a one-row strip after scrolling in WezTerm
    • Many more fixes and improvements; see upstream's release notes for the full list

  • Refresh the vendored node_modules over 1.0.0 -> 1.0.2: the ten @earendil-works packages move to 1.0.2, with pi-telemetry the one that was already at 1.0.2 in the 1.0.1 tree, plus @anthropic-ai/sdk to 0.129.0. No module leaves or joins the 119 shipped ones and the licence union is unchanged

    • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it. Upstream's 1.0.1 made…
Record
openSUSE-SU-2026:22111-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-102278 No score

CVE-2026-102278 in brace-expansion - Patched by Root

Root has patched CVE-2026-102278 in the brace-expansion package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-102278
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
brace-expansion
npm
 4.0.0 up to 5.0.11
5.0.11
brace-expansion
npm
 3.0.0 up to 3.0.8
3.0.8
brace-expansion
npm
 2.0.0 up to 2.1.6
2.1.6
brace-expansion
npm
 before 1.1.20
1.1.20
nodejs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-devel
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-docs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-libs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-nodemon
AlmaLinux:8
From an advisory covering 13 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
Show 115 moreShow less
Affected packages
PackageAffectedFixed
nodejs-packaging
AlmaLinux:8
From an advisory covering 13 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 13 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
v8-13.6-devel
AlmaLinux:8
From an advisory covering 13 CVEs
 before 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
nodejs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-docs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-libs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-nodemon
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 13 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 13 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
v8-13.6-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
nodejs-nodemon
Azure Linux:3
 through 2.0.3-5 None known
python-tensorboard
Azure Linux:3
 through 2.16.2-6 None known
brace-expansion
TuxCare:npm
From an advisory covering 2 CVEs
 4.0.1-tuxcare.0 up to 4.0.1-tuxcare.2, plus listed versions
4.0.14.0.1-tuxcare.1
4.0.1-tuxcare.2
brace-expansion
TuxCare:npm
 2.0.2-tuxcare.0 up to 2.0.2-tuxcare.3, plus listed versions
2.0.22.0.2-tuxcare.12.0.2-tuxcare.2
2.0.2-tuxcare.3
brace-expansion
TuxCare:npm
 1.1.18-tuxcare.0 up to 1.1.18-tuxcare.3, plus listed versions
1.1.181.1.18-tuxcare.11.1.18-tuxcare.2
1.1.18-tuxcare.3
brace-expansion
TuxCare:npm
From an advisory covering 3 CVEs
 2.0.1-tuxcare.0 up to 2.0.1-tuxcare.4, plus listed versions
2.0.12.0.1-tuxcare.12.0.1-tuxcare.22.0.1-tuxcare.3
2.0.1-tuxcare.4
brace-expansion
TuxCare:npm
 1.1.16-tuxcare.0 up to 1.1.16-tuxcare.3, plus listed versions
1.1.161.1.16-tuxcare.11.1.16-tuxcare.2
1.1.16-tuxcare.3
brace-expansion
TuxCare:npm
 1.1.15-tuxcare.0 up to 1.1.15-tuxcare.3, plus listed versions
1.1.151.1.15-tuxcare.11.1.15-tuxcare.2
1.1.15-tuxcare.3
brace-expansion
TuxCare:npm
 1.1.14-tuxcare.0 up to 1.1.14-tuxcare.3, plus listed versions
1.1.141.1.14-tuxcare.11.1.14-tuxcare.2
1.1.14-tuxcare.3
brace-expansion
TuxCare:npm
 5.0.10-tuxcare.0 up to 5.0.10-tuxcare.1, plus listed versions
5.0.10
5.0.10-tuxcare.1
brace-expansion
TuxCare:npm
 5.0.9-tuxcare.0 up to 5.0.9-tuxcare.2, plus listed versions
5.0.95.0.9-tuxcare.1
5.0.9-tuxcare.2
brace-expansion
TuxCare:npm
 5.0.8-tuxcare.0 up to 5.0.8-tuxcare.3, plus listed versions
5.0.85.0.8-tuxcare.15.0.8-tuxcare.2
5.0.8-tuxcare.3
brace-expansion
TuxCare:npm
 2.1.4-tuxcare.0 up to 2.1.4-tuxcare.3, plus listed versions
2.1.42.1.4-tuxcare.12.1.4-tuxcare.2
2.1.4-tuxcare.3
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
 1.1.11-tuxcare.0 up to 1.1.11-tuxcare.3, plus listed versions
1.1.111.1.11-tuxcare.11.1.11-tuxcare.2
1.1.11-tuxcare.3
brace-expansion
TuxCare:npm
 2.1.2-tuxcare.0 up to 2.1.2-tuxcare.5, plus listed versions
2.1.22.1.2-tuxcare.12.1.2-tuxcare.22.1.2-tuxcare.32.1.2-tuxcare.4
2.1.2-tuxcare.5
brace-expansion
TuxCare:npm
 2.1.3-tuxcare.0 up to 2.1.3-tuxcare.4, plus listed versions
2.1.32.1.3-tuxcare.12.1.3-tuxcare.22.1.3-tuxcare.3
2.1.3-tuxcare.4
brace-expansion
TuxCare:npm
From an advisory covering 6 CVEs
 5.0.5-tuxcare.0 up to 5.0.5-tuxcare.2, plus listed versions
5.0.55.0.5-tuxcare.1
5.0.5-tuxcare.2
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
 5.0.4-tuxcare.0 up to 5.0.4-tuxcare.3, plus listed versions
5.0.45.0.4-tuxcare.15.0.4-tuxcare.2
5.0.4-tuxcare.3
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
 1.1.12-tuxcare.0 up to 1.1.12-tuxcare.5, plus listed versions
1.1.121.1.12-tuxcare.11.1.12-tuxcare.21.1.12-tuxcare.3
1.1.12-tuxcare.5
brace-expansion
TuxCare:npm
From an advisory covering 6 CVEs
 5.0.6-tuxcare.0 up to 5.0.6-tuxcare.1, plus listed versions
5.0.6
5.0.6-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 7 CVEs
 5.0.3-tuxcare.0 up to 5.0.3-tuxcare.1, plus listed versions
5.0.3
5.0.3-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 7 CVEs
 5.0.2-tuxcare.0 up to 5.0.2-tuxcare.1, plus listed versions
5.0.2
5.0.2-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 5 CVEs
 1.1.3-tuxcare.0 up to 1.1.3-tuxcare.2, plus listed versions
1.1.31.1.3-tuxcare.1
1.1.3-tuxcare.2
brace-expansion
TuxCare:npm
From an advisory covering 2 CVEs
 1.1.1-tuxcare.0 up to 1.1.1-tuxcare.1, plus listed versions
1.1.1
1.1.1-tuxcare.1
node-brace-expansion
Debian:12
 All versions, plus listed versions
2.0.1+~1.1.0-12.0.1+~1.1.0-22.0.1-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-12.1.7+~1.1.2-1
 None known
node-brace-expansion
Debian:13
 All versions, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-12.1.7+~1.1.2-1
 None known
node-brace-expansion
Debian:14
 before 2.1.7+~1.1.2-1, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-1
2.1.7+~1.1.2-1
nodejs26
Red Hat:hummingbird:1
 before 0:26.10.0-0.2.hum1
0:26.10.0-0.2.hum1
nodejs26-bin
Red Hat:hummingbird:1
 before 0:26.10.0-0.2.hum1
0:26.10.0-0.2.hum1
nodejs26-devel
Red Hat:hummingbird:1
 before 0:26.10.0-0.2.hum1
0:26.10.0-0.2.hum1
nodejs26-docs
Red Hat:hummingbird:1
 before 0:26.10.0-0.2.hum1
0:26.10.0-0.2.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
 before 0:26.10.0-0.2.hum1
0:26.10.0-0.2.hum1
nodejs26-libs
Red Hat:hummingbird:1
 before 0:26.10.0-0.2.hum1
0:26.10.0-0.2.hum1
nodejs26-npm
Red Hat:hummingbird:1
 before 0:11.19.1-1.26.10.0.0.2.hum1
0:11.19.1-1.26.10.0.0.2.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
 before 0:26.10.0-0.2.hum1
0:26.10.0-0.2.hum1
v8-14.6-devel
Red Hat:hummingbird:1
 before 0:14.6.202.34-1.26.10.0.0.2.hum1
0:14.6.202.34-1.26.10.0.0.2.hum1
nodejs22
Red Hat:hummingbird:1
 before 0:22.23.3-2.3.2.1.hum1
0:22.23.3-2.3.2.1.hum1
nodejs22-bin
Red Hat:hummingbird:1
 before 0:22.23.3-2.3.2.1.hum1
0:22.23.3-2.3.2.1.hum1
nodejs22-devel
Red Hat:hummingbird:1
 before 0:22.23.3-2.3.2.1.hum1
0:22.23.3-2.3.2.1.hum1
nodejs22-docs
Red Hat:hummingbird:1
 before 0:22.23.3-2.3.2.1.hum1
0:22.23.3-2.3.2.1.hum1
nodejs22-full-i18n
Red Hat:hummingbird:1
 before 0:22.23.3-2.3.2.1.hum1
0:22.23.3-2.3.2.1.hum1
nodejs22-libs
Red Hat:hummingbird:1
 before 0:22.23.3-2.3.2.1.hum1
0:22.23.3-2.3.2.1.hum1
nodejs22-npm
Red Hat:hummingbird:1
 before 0:10.9.9-1.22.23.3.2.3.2.1.hum1
0:10.9.9-1.22.23.3.2.3.2.1.hum1
nodejs22-npm-bin
Red Hat:hummingbird:1
 before 0:22.23.3-2.3.2.1.hum1
0:22.23.3-2.3.2.1.hum1
v8-12.4-devel
Red Hat:hummingbird:1
 before 0:12.4.254.21-1.22.23.3.2.3.2.1.hum1
0:12.4.254.21-1.22.23.3.2.3.2.1.hum1
nodejs24
Red Hat:hummingbird:1
 before 0:24.21.0-1.1.hum1
0:24.21.0-1.1.hum1
nodejs24-bin
Red Hat:hummingbird:1
 before 0:24.21.0-1.1.hum1
0:24.21.0-1.1.hum1
nodejs24-devel
Red Hat:hummingbird:1
 before 0:24.21.0-1.1.hum1
0:24.21.0-1.1.hum1
nodejs24-docs
Red Hat:hummingbird:1
 before 0:24.21.0-1.1.hum1
0:24.21.0-1.1.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
 before 0:24.21.0-1.1.hum1
0:24.21.0-1.1.hum1
nodejs24-libs
Red Hat:hummingbird:1
 before 0:24.21.0-1.1.hum1
0:24.21.0-1.1.hum1
nodejs24-npm
Red Hat:hummingbird:1
 before 0:11.19.0-1.24.21.0.1.1.hum1
0:11.19.0-1.24.21.0.1.1.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
 before 0:11.19.0-1.24.21.0.1.1.hum1
0:11.19.0-1.24.21.0.1.1.hum1
v8-13.6-devel
Red Hat:hummingbird:1
 before 0:13.6.233.17-1.24.21.0.1.1.hum1
0:13.6.233.17-1.24.21.0.1.1.hum1
nodejs22
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:10.9.9-1.22.23.3.2.3.2.2.hum1
0:10.9.9-1.22.23.3.2.3.2.2.hum1
nodejs22-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:11.19.0-1.24.21.0.1.2.hum1
0:11.19.0-1.24.21.0.1.2.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:11.19.0-1.24.21.0.1.2.hum1
0:11.19.0-1.24.21.0.1.2.hum1
v8-13.6-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:13.6.233.17-1.24.21.0.1.2.hum1
0:13.6.233.17-1.24.21.0.1.2.hum1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:11.19.1-1.26.10.0.0.3.hum1
0:11.19.1-1.26.10.0.0.3.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs
Rocky Linux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module+el9.8.0+40401+e24b8c95
1:24.22.1-3.module+el9.8.0+40401+e24b8c95
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
brace-expansion
Root:npm
 before 5.0.6-aikido.6
5.0.6-aikido.62.1.4-aikido.12.1.4-aikido.21.1.13-aikido.41.1.12-aikido.61.1.13-aikido.52.0.1-aikido.71.1.14-aikido.41.1.11-aikido.71.1.14-aikido.55.0.8-aikido.21.1.19-aikido.15.0.8-aikido.35.0.9-aikido.15.0.7-aikido.42.0.2-aikido.61.1.18-aikido.22.1.0-aikido.55.0.5-aikido.55.0.3-aikido.6
@rootio/brace-expansion
Root:npm
 before 5.0.6-root.io.6
5.0.6-root.io.62.1.4-root.io.12.1.4-root.io.21.1.13-root.io.41.1.12-root.io.61.1.13-root.io.51.1.19-root.io.12.0.1-root.io.71.1.14-root.io.41.1.11-root.io.71.1.14-root.io.55.0.8-root.io.25.0.8-root.io.35.0.9-root.io.15.0.7-root.io.42.0.2-root.io.61.1.18-root.io.22.1.0-root.io.55.0.5-root.io.55.0.3-root.io.6
node-brace-expansion
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.8-1
 None known
node-brace-expansion
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.1.8-11.1.11-1
 None known
node-brace-expansion
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.0-12.0.1-1
 None known
node-brace-expansion
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.0.1-22.0.1+~1.1.0-1
 None known
node-brace-expansion
Ubuntu:26.10
 All versions, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-1
 None known
node-brace-expansion
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.0.1+~1.1.0-2
 None known
pi-coding-agent
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.0.0-1.1
1.0.0-1.1
pi-coding-agent
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 1.0.4-bp160.1.1
1.0.4-bp160.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-102278 is a high vulnerability (CVSS 7.5) in Juliangruber Brace-expansion, published September 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in brace-expansion 5.0.11.

References

Show 93 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open