Summary
[3.1.14-5]
- CVE-2026-102278 nodejs-nodemon: brace-expansion: Denial of Service via
uncontrolled recursion in nested brace patterns
[3.1.14-4]
- CVE-2026-102276 nodejs-nodemon: brace-expansion: Denial of Service via
stack exhaustion from crafted brace patterns
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | nodejs-nodemon | 0:3.1.14-5.el10_2 |
Vulnerabilities 2
-
High 7.5
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …
-
High 7.5
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…