brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
### Summary `parseCommaParts()` can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string. This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made `expand_()` iterative and documented a constant-stack-depth guarantee, but `parseCommaParts()` was left recursive, so the guarantee only held for one of the two parsing paths. ### Vector 1 - unbounded recursion on `post` `parseCommaParts()` recursed on the remainder of the string once per brace group: ```js const postParts = parseCommaParts(post) // unbounded ``` A brace group containing many comma-separated groups drives one recursion level per group: ```js expand('{' + '{a},'.repeat(7000) + 'b}') // RangeError: Maximum call stack size exceeded ``` About 7,300 repetitions - roughly 29 KB of input - is enough on Node 24; roughly 6,300 (25 KB) on Node 18. The threshold is identical on every affected release line. ### Vector 2 - `push.apply` with an unbounded array Even with the recursion removed, `parseCommaParts()` spread whole arrays into an argument list: ```js p.push.apply(p, postParts) parts.push.apply(parts, p) ``` `Function.prototype.apply` places one argument per element on the stack, so a single large array overflows it. This needs **no recursion depth at all** - the following reaches a recursion depth of exactly 1: ```js expand('{{x},' + 'a,'.repeat(125000) + 'b}') // RangeError: Maximum call stack
GHSA-6j4f-fj2g-mc7p
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-6j4f-fj2g-mc7p
brace-expansion
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 5.0.10
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
brace-expansion
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.0.7
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
brace-expansion
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.1.5
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
brace-expansion
Source reference: /affected/3/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.1.19
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "5.0.10"
}
]
}
],
"package": {
"name": "brace-expansion",
"purl": "pkg:npm/brace-expansion",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6j4f-fj2g-mc7p/GHSA-6j4f-fj2g-mc7p.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.7"
}
]
}
],
"package": {
"name": "brace-expansion",
"purl": "pkg:npm/brace-expansion",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6j4f-fj2g-mc7p/GHSA-6j4f-fj2g-mc7p.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.1.5"
}
]
}
],
"package": {
"name": "brace-expansion",
"purl": "pkg:npm/brace-expansion",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6j4f-fj2g-mc7p/GHSA-6j4f-fj2g-mc7p.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.19"
}
]
}
],
"package": {
"name": "brace-expansion",
"purl": "pkg:npm/brace-expansion",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6j4f-fj2g-mc7p/GHSA-6j4f-fj2g-mc7p.json"
}
}
]- Related CVEs
- CVE-2026-102276
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #33262 · Revision 1
- Added to Heist Feed
- Publisher date