Skip to content
Heist/ feed
HighFix available

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Type: advisorySource: OSV1 source record

### Summary `parseCommaParts()` can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string. This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made `expand_()` iterative and documented a constant-stack-depth guarantee, but `parseCommaParts()` was left recursive, so the guarantee only held for one of the two parsing paths. ### Vector 1 - unbounded recursion on `post` `parseCommaParts()` recursed on the remainder of the string once per brace group: ```js const postParts = parseCommaParts(post) // unbounded ``` A brace group containing many comma-separated groups drives one recursion level per group: ```js expand('{' + '{a},'.repeat(7000) + 'b}') // RangeError: Maximum call stack size exceeded ``` About 7,300 repetitions - roughly 29 KB of input - is enough on Node 24; roughly 6,300 (25 KB) on Node 18. The threshold is identical on every affected release line. ### Vector 2 - `push.apply` with an unbounded array Even with the recursion removed, `parseCommaParts()` spread whole arrays into an argument list: ```js p.push.apply(p, postParts) parts.push.apply(parts, p) ``` `Function.prototype.apply` places one argument per element on the stack, so a single large array overflows it. This needs **no recursion depth at all** - the following reaches a recursion depth of exactly 1: ```js expand('{{x},' + 'a,'.repeat(125000) + 'b}') // RangeError: Maximum call stack

Announced Source revision 1
Original source ↗

GHSA-6j4f-fj2g-mc7p

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-6j4f-fj2g-mc7p

brace-expansion

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
5.0.10

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

brace-expansion

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
3.0.7

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

brace-expansion

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
2.1.5

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

brace-expansion

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
1.1.19

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "4.0.0"
          },
          {
            "fixed": "5.0.10"
          }
        ]
      }
    ],
    "package": {
      "name": "brace-expansion",
      "purl": "pkg:npm/brace-expansion",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6j4f-fj2g-mc7p/GHSA-6j4f-fj2g-mc7p.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "3.0.0"
          },
          {
            "fixed": "3.0.7"
          }
        ]
      }
    ],
    "package": {
      "name": "brace-expansion",
      "purl": "pkg:npm/brace-expansion",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6j4f-fj2g-mc7p/GHSA-6j4f-fj2g-mc7p.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "2.0.0"
          },
          {
            "fixed": "2.1.5"
          }
        ]
      }
    ],
    "package": {
      "name": "brace-expansion",
      "purl": "pkg:npm/brace-expansion",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6j4f-fj2g-mc7p/GHSA-6j4f-fj2g-mc7p.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.1.19"
          }
        ]
      }
    ],
    "package": {
      "name": "brace-expansion",
      "purl": "pkg:npm/brace-expansion",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6j4f-fj2g-mc7p/GHSA-6j4f-fj2g-mc7p.json"
    }
  }
]
Related CVEs
CVE-2026-102276

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-102276 · High

brace-expansion

Event
#33262 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement