CVE WATCH / VULNERABILITY DETAIL
CVE-2026-102278
HIGHCVSS 7.5NVD feed
Published 28 September 2026 · tracked since 29 September 2026
Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before ou
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-110199 MEDIUM 4.8
- CVE-2026-128128 HIGH 7.5
- CVE-2026-127217 MEDIUM 6.4
- CVE-2026-127216 MEDIUM 6.5
- CVE-2026-68905 HIGH 8.2
- CVE-2026-128089 HIGH 7.5
- CVE-2026-127215 HIGH 8.1
- CVE-2026-127214 HIGH 8.5
- CVE-2026-128088 LOW 2.2
- CVE-2026-128087 LOW 3.7