Search: CVE-2026-102278

CVE-2026-102278 is a high-severity vulnerability in the juliangruber brace-expansion library. It involves uncontrolled recursion in the expand_() function when processing deeply nested brace groups, which can exhaust the native stack and cause the Node.js process to terminate. This leads to a denial of service condition. The issue affects multiple versions prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, where the recursion occurs at comma-member and single-set expansion sites. The vulnerability is fixed in these versions.