The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to
    1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts
    because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to
    pass every element of a very large comma-part array as a function argument. Patterns containing many
    comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array
    path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before
    max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating
    denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10. (CVE-2026-102276)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to     1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts     because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to     pass every element of a very large comma-part array as a function argument. Patterns containing many     comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array     path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before     max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating     denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10. (CVE-2026-102276)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460089	Echo: node-brace-expansion: security update to 2.0.1+~1.1.0-2+e4	Tenable Cloud Security	Echo Local Security Checks	Local	high
460089	Echo: node-brace-expansion: security update to 2.0.1+~1.1.0-2+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351380	Linux Distros Unpatched Vulnerability : CVE-2026-102276	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102276

high

Tenable Plugins

high

high

high