Skip to content
Heist/ feed
HighFix available

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Type: advisorySource: OSV1 source record

### Summary `expand_()` recurses once per level of brace *nesting*. Deeply nested input exhausts the native stack and crashes the process. This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the *tail* iterative (recursion on `m.post`, driven by how many groups are chained). Nesting depth drives a different recursion that the tail fix never touched, so the documented constant-stack-depth guarantee only ever covered chained input, not nested input. It is also distinct from GHSA-6j4f-fj2g-mc7p, which fixed recursion in `parseCommaParts()`. Both payloads below still crash with that fix applied. ### Two recursion sites **Comma members.** Each alternative of a brace set is expanded by a recursive call, so nesting a set inside every alternative recurses once per level: ```js expand('{a,'.repeat(4000) + 'z' + '}'.repeat(4000)) // RangeError: Maximum call stack size exceeded ``` Crashes at depth 3,907 - about **15.6 KB** of input. **Single set.** A brace set whose body parses to a single part is expanded by a recursive call before being re-wrapped (`x{{a,b}}y` -> `x{a}y x{b}y`), which recurses once per nesting level: ```js expand('{'.repeat(3200) + 'a,b' + '}'.repeat(3200)) // RangeError: Maximum call stack size exceeded ``` Crashes at depth 3,125 - about **6.25 KB** of input. This is the cheapest stack-exhaustion payload known against this package: roughly a quarter the input of GHSA-6j4f-fj2g-mc7p (29 KB), and about a tenth of minimatch's `MAX_PATTERN_LENGTH` (65

Announced Source revision 1
Original source ↗

GHSA-qhr7-859c-m2p7

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-qhr7-859c-m2p7

brace-expansion

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
5.0.11

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

brace-expansion

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
3.0.8

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

brace-expansion

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
2.1.6

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

brace-expansion

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
1.1.20

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "4.0.0"
          },
          {
            "fixed": "5.0.11"
          }
        ]
      }
    ],
    "package": {
      "name": "brace-expansion",
      "purl": "pkg:npm/brace-expansion",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qhr7-859c-m2p7/GHSA-qhr7-859c-m2p7.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "3.0.0"
          },
          {
            "fixed": "3.0.8"
          }
        ]
      }
    ],
    "package": {
      "name": "brace-expansion",
      "purl": "pkg:npm/brace-expansion",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qhr7-859c-m2p7/GHSA-qhr7-859c-m2p7.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "2.0.0"
          },
          {
            "fixed": "2.1.6"
          }
        ]
      }
    ],
    "package": {
      "name": "brace-expansion",
      "purl": "pkg:npm/brace-expansion",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qhr7-859c-m2p7/GHSA-qhr7-859c-m2p7.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.1.20"
          }
        ]
      }
    ],
    "package": {
      "name": "brace-expansion",
      "purl": "pkg:npm/brace-expansion",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qhr7-859c-m2p7/GHSA-qhr7-859c-m2p7.json"
    }
  }
]
Related CVEs
CVE-2026-102278

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-102278 · High

brace-expansion

Event
#33271 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement