The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to
    1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting
    level at comma-member and single-set expansion sites, exhausting the native stack before output limits can
    apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested
    brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern.
    expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack
    exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in
    versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11. (CVE-2026-102278)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to     1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting     level at comma-member and single-set expansion sites, exhausting the native stack before output limits can     apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested     brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern.
    expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack     exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in     versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11. (CVE-2026-102278)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460601	Echo: node-brace-expansion: security update to 2.0.1+~1.1.0-2+e4	Tenable Cloud Security	Echo Local Security Checks	Local	high
460601	Echo: node-brace-expansion: security update to 2.0.1+~1.1.0-2+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351301	Linux Distros Unpatched Vulnerability : CVE-2026-102278	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102278

high

Tenable Plugins

high

high

high