Every CVE Search/ Get API key

CVE-2026-102276

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

7.5 HighFix available

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.46%Up 0.1 points since Sep 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
EUVDEUVD-2026-88550 7.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
EUVD-2026-88550
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6j4f-fj2g-mc7p 7.5

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Summary

parseCommaParts() can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string.

This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made expand_() iterative and documented a constant-stack-depth guarantee, but parseCommaParts() was left recursive, so the guarantee only held for one of the two parsing paths.

Vector 1 - unbounded recursion on post

parseCommaParts() recursed on the remainder of the string once per brace group:

const postParts = parseCommaParts(post)   // unbounded

A brace group containing many comma-separated groups drives one recursion level per group:

expand('{' + '{a},'.repeat(7000) + 'b}')
// RangeError: Maximum call stack size exceeded

About 7,300 repetitions - roughly 29 KB of input - is enough on Node 24; roughly 6,300 (25 KB) on Node 18. The threshold is identical on every affected release line.

Vector 2 - push.apply with an unbounded array

Even with the recursion removed, parseCommaParts() spread whole arrays into an argument list:

p.push.apply(p, postParts)
parts.push.apply(parts, p)

Function.prototype.apply places one argument per element on the stack, so a single large array overflows it. This needs no recursion depth at all - the following reaches a recursion depth of exactly 1:

expand('{{x},' + 'a,'.repeat(125000) + 'b}')
// RangeError: Maximum call stack size exceeded

Threshold is about 124,300 repetitions (~249 KB). This vector was not part of the original report; it was found while verifying the fix. A patch that only de-recurses but keeps push.apply leaves a working denial of service behind.

Why max and maxLength do not help

Both crashes happen during parsing, before any expansion. The payloads produce one result per group, so output size grows linearly with input and is never the limiter. expand(payload, { max: 1, maxLength: 1 }) still overflows.

Impact

Any application that passes an untrusted string to expand() - directly, or through minimatch / glob where it is a user-supplied glob pattern - can be crashed. In Node, a RangeError that the application does not catch terminates the process, so a server that globs user input is exposed to remote unauthenticated denial of service.

minimatch's own MAX_PATTERN_LENGTH cap (65,536) does not help against vector 1: the overflow threshold sits well below it. Confirmed on minimatch 10.2.6 - a 64,003-byte pattern passes the length check and overflows both minimatch.braceExpand() and new minimatch.Minimatch().

This is an availability-only issue. No code execution and no data exposure.

Not a regression

5.0.8 and 5.0.9 overflow at the same repetition count, so the gap predates the recent advisories; those fixes simply did not reach it. Verified affected on 1.1.18, 2.1.4, 3.0.6, 5.0.8 and 5.0.9, all at an identical threshold.

Patch

parseCommaParts() is rewritten as a loop that carries the partial part across chunks, and every array append uses an element-by-element loop rather than push.apply. The redundant if (!str) return [''] guard is dropped - the loop returns [''] for the empty string on its own.

Equivalence of the old and new implementations was checked by differential testing: exhaustive over every string of {, }, ,, a up to length 7 plus 300,000 random inputs - 322,000 cases, zero mismatches.

Severity note

Scored 7.5 High under CVSS 3.1 for consistency with the other availability advisories on this package (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895), which use the same vector. The reporter self-assessed 6.9 Medium under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

Credit

Reported by baeseungwon1010, with a working proof of concept and a proposed patch. Vector 2 was identified during maintainer verification.

Record
GHSA-6j4f-fj2g-mc7p
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
NVD 7.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
OSV 7.5

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
OSVDEBIAN-CVE-2026-102276 7.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
DEBIAN-CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 37 moreShow less
OSVGHSA-6j4f-fj2g-mc7p 7.5

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Summary

parseCommaParts() can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string.

This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made expand_() iterative and documented a constant-stack-depth guarantee, but parseCommaParts() was left recursive, so the guarantee only held for one of the two parsing paths.

Vector 1 - unbounded recursion on post

parseCommaParts() recursed on the remainder of the string once per brace group:

const postParts = parseCommaParts(post)   // unbounded

A brace group containing many comma-separated groups drives one recursion level per group:

expand('{' + '{a},'.repeat(7000) + 'b}')
// RangeError: Maximum call stack size exceeded

About 7,300 repetitions - roughly 29 KB of input - is enough on Node 24; roughly 6,300 (25 KB) on Node 18. The threshold is identical on every affected release line.

Vector 2 - push.apply with an unbounded array

Even with the recursion removed, parseCommaParts() spread whole arrays into an argument list:

p.push.apply(p, postParts)
parts.push.apply(parts, p)

Function.prototype.apply places one argument per element on the stack, so a single large array overflows it. This needs no recursion depth at all - the following reaches a recursion depth of exactly 1:

expand('{{x},' + 'a,'.repeat(125000) + 'b}')
// RangeError: Maximum call stack size exceeded

Threshold is about 124,300 repetitions (~249 KB). This vector was not part of the original report; it was found while verifying the fix. A patch that only de-recurses but keeps push.apply leaves a working denial of service behind.

Why max and maxLength do not help

Both crashes happen during parsing, before any expansion. The payloads produce one result per group, so output size grows linearly with input and is never the limiter. expand(payload, { max: 1, maxLength: 1 }) still overflows.

Impact

Any application that passes an untrusted string to expand() - directly, or through minimatch / glob where it is a user-supplied glob pattern - can be crashed. In Node, a RangeError that the application does not catch terminates the process, so a server that globs user input is exposed to remote unauthenticated denial of service.

minimatch's own MAX_PATTERN_LENGTH cap (65,536) does not help against vector 1: the overflow threshold sits well below it. Confirmed on minimatch 10.2.6 - a 64,003-byte pattern passes the length check and overflows both minimatch.braceExpand() and new minimatch.Minimatch().

This is an availability-only issue. No code execution and no data exposure.

Not a regression

5.0.8 and 5.0.9 overflow at the same repetition count, so the gap predates the recent advisories; those fixes simply did not reach it. Verified affected on 1.1.18, 2.1.4, 3.0.6, 5.0.8 and 5.0.9, all at an identical threshold.

Patch

parseCommaParts() is rewritten as a loop that carries the partial part across chunks, and every array append uses an element-by-element loop rather than push.apply. The redundant if (!str) return [''] guard is dropped - the loop returns [''] for the empty string on its own.

Equivalence of the old and new implementations was checked by differential testing: exhaustive over every string of {, }, ,, a up to length 7 plus 300,000 random inputs - 322,000 cases, zero mismatches.

Severity note

Scored 7.5 High under CVSS 3.1 for consistency with the other availability advisories on this package (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895), which use the same vector. The reporter self-assessed 6.9 Medium under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

Credit

Reported by baeseungwon1010, with a working proof of concept and a proposed patch. Vector 2 was identified during maintainer verification.

Record
GHSA-6j4f-fj2g-mc7p
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
OSVRHSA-2026:74161 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:74161
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:74167 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:74167
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:74168 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:74168
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:84657 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:84657
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:92376 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92376
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:92378 8.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92378
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-102276 7.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
UBUNTU-CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:92376 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92376
Updated
2026-11-02
OSVALSA-2026:92378 No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92378
Updated
2026-11-02
OSVAZL-105075 No score

CVE-2026-102276 affecting package js-jquery 3.5.0-4

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
AZL-105075
Updated
2026-11-05
OSVAZL-105096 No score

CVE-2026-102276 affecting package nodejs-nodemon 2.0.3-5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
AZL-105096
Updated
2026-11-05
OSVAZL-105248 No score

CVE-2026-102276 affecting package python-tensorboard 2.16.2-6

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
AZL-105248
Updated
2026-11-02
OSVCLSA-2026-1790807349 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 4.0.1-tuxcare.1.

Record
CLSA-2026-1790807349
Updated
2026-11-02
OSVCLSA-2026-1790807354 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.0.2-tuxcare.1.

Record
CLSA-2026-1790807354
Updated
2026-11-02
OSVCLSA-2026-1790807467 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.1.

Record
CLSA-2026-1790807467
Updated
2026-11-02
OSVCLSA-2026-1790856945 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.16-tuxcare.1.

Record
CLSA-2026-1790856945
Updated
2026-11-02
OSVCLSA-2026-1790863041 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.15-tuxcare.1.

Record
CLSA-2026-1790863041
Updated
2026-11-02
OSVCLSA-2026-1790864778 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.14-tuxcare.1.

Record
CLSA-2026-1790864778
Updated
2026-11-02
OSVCLSA-2026-1790887113 No score

TuxCare security update for brace-expansion (3 CVEs)

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 2.0.1-tuxcare.4.

Record
CLSA-2026-1790887113
Updated
2026-11-02
OSVCLSA-2026-1791215851 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.9-tuxcare.1.

Record
CLSA-2026-1791215851
Updated
2026-11-02
OSVCLSA-2026-1791215922 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.4-tuxcare.1.

Record
CLSA-2026-1791215922
Updated
2026-11-02
OSVCLSA-2026-1791226379 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.3-tuxcare.2.

Record
CLSA-2026-1791226379
Updated
2026-11-02
OSVCLSA-2026-1791226863 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.8-tuxcare.2.

Record
CLSA-2026-1791226863
Updated
2026-11-02
OSVCLSA-2026-1791278923 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.2-tuxcare.3.

Record
CLSA-2026-1791278923
Updated
2026-11-02
OSVCLSA-2026-1791626852 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.3.

Record
CLSA-2026-1791626852
Updated
2026-11-02
OSVCLSA-2026-1791629378 No score

TuxCare security update for brace-expansion (2 CVEs)

TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 5.0.4-tuxcare.2.

Record
CLSA-2026-1791629378
Updated
2026-11-02
OSVCLSA-2026-1791798665 No score

TuxCare security update for brace-expansion (6 CVEs)

TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.5-tuxcare.2.

Record
CLSA-2026-1791798665
Updated
2026-11-02
OSVCLSA-2026-1792233030 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.12-tuxcare.5.

Record
CLSA-2026-1792233030
Updated
2026-11-02
OSVCLSA-2026-1792448853 No score

TuxCare security update for brace-expansion (6 CVEs)

TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.6-tuxcare.1.

Record
CLSA-2026-1792448853
Updated
2026-11-02
OSVCLSA-2026-1792453589 No score

TuxCare security update for brace-expansion (7 CVEs)

TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.3-tuxcare.1.

Record
CLSA-2026-1792453589
Updated
2026-11-02
OSVCLSA-2026-1792479350 No score

TuxCare security update for brace-expansion (7 CVEs)

TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.2-tuxcare.1.

Record
CLSA-2026-1792479350
Updated
2026-11-02
OSVCLSA-2026-1793102029 No score

TuxCare security update for brace-expansion (5 CVEs)

TuxCare rebuilt brace-expansion to address 5 CVEs. Fixed in 1.1.3-tuxcare.2.

Record
CLSA-2026-1793102029
Updated
2026-11-02
OSVCLSA-2026-1793180819 No score

TuxCare security update for brace-expansion (2 CVEs)

TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.

Record
CLSA-2026-1793180819
Updated
2026-11-02
OSVopenSUSE-SU-2026:12062-1 No score

pi-coding-agent-1.0.2-1.1 on GA media

These are all security issues fixed in the pi-coding-agent-1.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12062-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22111-1 No score

Security update for pi-coding-agent

This update for pi-coding-agent fixes the following issues:

Changes in pi-coding-agent:

  • Update to version 1.0.4 (1.0.3 was superseded the same day and never submitted):

    • BREAKING: provider azure-openai-responses renamed to azure, now also serving Azure Foundry Chat Completions (azure/deepseek-v4-pro first). Rename the provider key in auth.json (or run /login again), models.json and settings.json (defaultProvider, enabledModels and modelThinkingLevels); sessions on the old provider fall back and lose prompt cache. AZURE_OPENAI_* env vars unchanged
    • --tools and --exclude-tools take *-patterns and --no-mcp disables MCP for one run; --tools keeps MCP tools unless an entry starts with mcp__
    • Codemode read() on image files yields an image block image() shows, and image() also saves each image to a temp file for later turns
    • Fix fenced-code highlighting past the first line, MCP OAuth native-client registration, MCP shutdown racing a connecting server, Bedrock stalled-stream retries and frozen codemode built-ins, plus ChatGPT-login, EIO-on-closed-terminal and output-file-permission fixes
    • Many more fixes and improvements; see upstream's release notes for the full list

  • Refresh the vendored node_modules 1.0.2 -> 1.0.4: the ten @earendil-works packages move to 1.0.4; nanoid, postcss and vite move too but are dev-only and not shipped. Still 119 shipped modules and the licence union is unchanged

    • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it
    • CVE-2026-102277 (boo#1283392) and CVE-2026-102278 (boo#1283412): brace-expansion is 5.0.12, at the 5.0.12 and above the 5.0.11 fix floors, so the package is not affected by them

  • Update to version 1.0.2: patch releases on the 1.0 API, with no breaking changes

    • models.json takes samplingParamsByThinkingLevel next to the existing samplingParams, so an OpenAI-compatible model can set temperature, top_p and the like separately for off, minimal, low, medium, high, xhigh and max. Model defaults, the effective level's override and the request are merged per key, modelOverrides merges per level, and the levels are pi's own, not the provider's thinkingLevelMap values. Only openai-completions, openai-responses and azure-openai-responses apply them
    • MCP servers can be enabled, disabled or re-scoped per project from a .pi/mcp.json entry without a command or url, and /mcp toggles a user-level server for the current project
    • oauth.clientRegistration: "cimd" identifies pi by its Client ID Metadata Document instead of dynamic client registration
    • pi.registerToolRenderer() picks how calls to a tool that is not registered yet are drawn, such as MCP tools in a resumed session
    • Cloudflare's Clef and Clef Flash classifier models are usable from codemode scripts and extensions
    • A codemode script printing in a loop now fails at 16 Mi characters or 100000 items instead of running pi out of memory
    • MCP tool calls in resumed sessions and HTML exports no longer render fully expanded until their server connects
    • JPEG, GIF and WebP images that extensions draw through Image now appear in Kitty, Ghostty, WezTerm and Warp, and fullscreen Kitty images no longer collapse to a one-row strip after scrolling in WezTerm
    • Many more fixes and improvements; see upstream's release notes for the full list

  • Refresh the vendored node_modules over 1.0.0 -> 1.0.2: the ten @earendil-works packages move to 1.0.2, with pi-telemetry the one that was already at 1.0.2 in the 1.0.1 tree, plus @anthropic-ai/sdk to 0.129.0. No module leaves or joins the 119 shipped ones and the licence union is unchanged

    • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it. Upstream's 1.0.1 made…
Record
openSUSE-SU-2026:22111-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-102276 No score

CVE-2026-102276 in brace-expansion - Patched by Root

Root has patched CVE-2026-102276 in the brace-expansion package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-102276
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
brace-expansion
npm
 4.0.0 up to 5.0.10
5.0.10
brace-expansion
npm
 3.0.0 up to 3.0.7
3.0.7
brace-expansion
npm
 2.0.0 up to 2.1.5
2.1.5
brace-expansion
npm
 before 1.1.19
1.1.19
nodejs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-devel
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-docs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-libs
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-nodemon
AlmaLinux:8
From an advisory covering 13 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
Show 96 moreShow less
Affected packages
PackageAffectedFixed
nodejs-packaging
AlmaLinux:8
From an advisory covering 13 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 13 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 13 CVEs
 before 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
v8-13.6-devel
AlmaLinux:8
From an advisory covering 13 CVEs
 before 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
nodejs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-docs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-libs
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-nodemon
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 13 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 13 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 13 CVEs
 before 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
v8-13.6-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
nodejs-nodemon
Azure Linux:3
 through 2.0.3-5 None known
python-tensorboard
Azure Linux:3
 through 2.16.2-6 None known
brace-expansion
TuxCare:npm
 4.0.1-tuxcare.0 up to 4.0.1-tuxcare.1, plus listed versions
4.0.1
4.0.1-tuxcare.1
brace-expansion
TuxCare:npm
 2.0.2-tuxcare.0 up to 2.0.2-tuxcare.1, plus listed versions
2.0.2
2.0.2-tuxcare.1
brace-expansion
TuxCare:npm
 1.1.18-tuxcare.0 up to 1.1.18-tuxcare.1, plus listed versions
1.1.18
1.1.18-tuxcare.1
brace-expansion
TuxCare:npm
 1.1.16-tuxcare.0 up to 1.1.16-tuxcare.1, plus listed versions
1.1.16
1.1.16-tuxcare.1
brace-expansion
TuxCare:npm
 1.1.15-tuxcare.0 up to 1.1.15-tuxcare.1, plus listed versions
1.1.15
1.1.15-tuxcare.1
brace-expansion
TuxCare:npm
 1.1.14-tuxcare.0 up to 1.1.14-tuxcare.1, plus listed versions
1.1.14
1.1.14-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 3 CVEs
 2.0.1-tuxcare.0 up to 2.0.1-tuxcare.4, plus listed versions
2.0.12.0.1-tuxcare.12.0.1-tuxcare.22.0.1-tuxcare.3
2.0.1-tuxcare.4
brace-expansion
TuxCare:npm
 5.0.9-tuxcare.0 up to 5.0.9-tuxcare.1, plus listed versions
5.0.9
5.0.9-tuxcare.1
brace-expansion
TuxCare:npm
 2.1.4-tuxcare.0 up to 2.1.4-tuxcare.1, plus listed versions
2.1.4
2.1.4-tuxcare.1
brace-expansion
TuxCare:npm
 2.1.3-tuxcare.0 up to 2.1.3-tuxcare.2, plus listed versions
2.1.32.1.3-tuxcare.1
2.1.3-tuxcare.2
brace-expansion
TuxCare:npm
 5.0.8-tuxcare.0 up to 5.0.8-tuxcare.2, plus listed versions
5.0.85.0.8-tuxcare.1
5.0.8-tuxcare.2
brace-expansion
TuxCare:npm
 2.1.2-tuxcare.0 up to 2.1.2-tuxcare.3, plus listed versions
2.1.22.1.2-tuxcare.12.1.2-tuxcare.2
2.1.2-tuxcare.3
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
 1.1.11-tuxcare.0 up to 1.1.11-tuxcare.3, plus listed versions
1.1.111.1.11-tuxcare.11.1.11-tuxcare.2
1.1.11-tuxcare.3
brace-expansion
TuxCare:npm
From an advisory covering 2 CVEs
 5.0.4-tuxcare.0 up to 5.0.4-tuxcare.2, plus listed versions
5.0.45.0.4-tuxcare.1
5.0.4-tuxcare.2
brace-expansion
TuxCare:npm
From an advisory covering 6 CVEs
 5.0.5-tuxcare.0 up to 5.0.5-tuxcare.2, plus listed versions
5.0.55.0.5-tuxcare.1
5.0.5-tuxcare.2
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
 1.1.12-tuxcare.0 up to 1.1.12-tuxcare.5, plus listed versions
1.1.121.1.12-tuxcare.11.1.12-tuxcare.21.1.12-tuxcare.3
1.1.12-tuxcare.5
brace-expansion
TuxCare:npm
From an advisory covering 6 CVEs
 5.0.6-tuxcare.0 up to 5.0.6-tuxcare.1, plus listed versions
5.0.6
5.0.6-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 7 CVEs
 5.0.3-tuxcare.0 up to 5.0.3-tuxcare.1, plus listed versions
5.0.3
5.0.3-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 7 CVEs
 5.0.2-tuxcare.0 up to 5.0.2-tuxcare.1, plus listed versions
5.0.2
5.0.2-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 5 CVEs
 1.1.3-tuxcare.0 up to 1.1.3-tuxcare.2, plus listed versions
1.1.31.1.3-tuxcare.1
1.1.3-tuxcare.2
brace-expansion
TuxCare:npm
From an advisory covering 2 CVEs
 1.1.1-tuxcare.0 up to 1.1.1-tuxcare.1, plus listed versions
1.1.1
1.1.1-tuxcare.1
node-brace-expansion
Debian:12
 All versions, plus listed versions
2.0.1+~1.1.0-12.0.1+~1.1.0-22.0.1-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-12.1.7+~1.1.2-1
 None known
node-brace-expansion
Debian:13
 All versions, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-12.1.7+~1.1.2-1
 None known
node-brace-expansion
Debian:14
 before 2.1.7+~1.1.2-1, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-1
2.1.7+~1.1.2-1
nodejs22
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs22-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:10.9.9-1.22.23.3.2.3.2.2.hum1
0:10.9.9-1.22.23.3.2.3.2.2.hum1
nodejs22-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:22.23.3-2.3.2.2.hum1
0:22.23.3-2.3.2.2.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:24.21.0-1.2.hum1
0:24.21.0-1.2.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:11.19.0-1.24.21.0.1.2.hum1
0:11.19.0-1.24.21.0.1.2.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:11.19.0-1.24.21.0.1.2.hum1
0:11.19.0-1.24.21.0.1.2.hum1
v8-13.6-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:13.6.233.17-1.24.21.0.1.2.hum1
0:13.6.233.17-1.24.21.0.1.2.hum1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:11.19.1-1.26.10.0.0.3.hum1
0:11.19.1-1.26.10.0.0.3.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:26.10.0-0.3.hum1
0:26.10.0-0.3.hum1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:11.20.0-1.26.11.1.0.4.hum1
0:11.20.0-1.26.11.1.0.4.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
v8-14.6-devel
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
 before 0:14.6.202.34-1.26.11.1.0.4.hum1
0:14.6.202.34-1.26.11.1.0.4.hum1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs
Rocky Linux:9
From an advisory covering 13 CVEs
 before 1:24.22.1-3.module+el9.8.0+40401+e24b8c95
1:24.22.1-3.module+el9.8.0+40401+e24b8c95
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
brace-expansion
Root:npm
 before 5.0.6-aikido.5
5.0.6-aikido.55.0.6-aikido.62.0.1-aikido.62.1.4-aikido.21.1.12-aikido.51.1.12-aikido.61.1.13-aikido.52.0.1-aikido.71.1.11-aikido.71.1.14-aikido.55.0.8-aikido.35.0.9-aikido.15.0.7-aikido.42.0.2-aikido.51.1.18-aikido.12.0.2-aikido.61.1.18-aikido.22.1.0-aikido.55.0.5-aikido.55.0.3-aikido.61.1.19-aikido.1
@rootio/brace-expansion
Root:npm
 before 5.0.6-root.io.5
5.0.6-root.io.55.0.6-root.io.62.0.1-root.io.62.1.4-root.io.21.1.12-root.io.51.1.12-root.io.61.1.13-root.io.52.0.1-root.io.71.1.11-root.io.71.1.14-root.io.55.0.8-root.io.35.0.9-root.io.15.0.7-root.io.42.0.2-root.io.51.1.18-root.io.12.0.2-root.io.61.1.18-root.io.22.1.0-root.io.55.0.5-root.io.55.0.3-root.io.61.1.19-root.io.1
node-brace-expansion
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.8-1
 None known
node-brace-expansion
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.1.8-11.1.11-1
 None known
node-brace-expansion
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.0-12.0.1-1
 None known
node-brace-expansion
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.0.1-22.0.1+~1.1.0-1
 None known
node-brace-expansion
Ubuntu:26.10
 All versions, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-1
 None known
node-brace-expansion
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.0.1+~1.1.0-2
 None known
pi-coding-agent
openSUSE:Tumbleweed
 before 1.0.2-1.1
1.0.2-1.1
pi-coding-agent
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 1.0.4-bp160.1.1
1.0.4-bp160.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-102276 is a high vulnerability (CVSS 7.5) in Juliangruber Brace-expansion, published September 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in brace-expansion 5.0.10.

References

Show 135 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open