Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| juliangruber | brace-expansion | >= 4.0.0, < 5.0.11, >= 3.0.0, < 3.0.8, >= 2.0.0, < 2.1.6, < 1.1.20 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-brace-expansion | 2.1.7+~1.1.2-1 | — |
| Debian 13 | node-brace-expansion | No fix yet | — |
| Debian 12 | node-brace-expansion | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-brace-expansion | No fix yet | — |
| Ubuntu 26.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 24.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 22.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 20.04 LTS | node-brace-expansion | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-brace-expansion | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs +4 | 1:22.23.4-1.el10_2 | ALSA-2026:96094 |
| AlmaLinux 10 | nodejs-nodemon | 3.1.14-5.el10_2 | ALSA-2026:96236 |
| AlmaLinux 10 | nodejs-npm | 1:10.9.9-1.22.23.4.1.el10_2 | ALSA-2026:96094 |
| AlmaLinux 10 | nodejs24 +4 | 1:24.22.1-3.el10_2 | ALSA-2026:96088 |
| AlmaLinux 10 | nodejs24-npm | 2:11.19.1-1.24.22.1.3.el10_2 | ALSA-2026:96088 |
| AlmaLinux 9 | nodejs +4 | 1:24.22.1-3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-3.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:92378 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:96234, ALSA-2026:92378 |
| AlmaLinux 9 | npm | 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux 8 | nodejs +4 | 1:22.23.4-2.module_el8.10.0+4358+709b81be | ALSA-2026:98113, ALSA-2026:98102, ALSA-2026:92376 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:98113, ALSA-2026:98102, ALSA-2026:92376 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:98113, ALSA-2026:98102, ALSA-2026:92376 |
| AlmaLinux 8 | npm | 1:10.9.9-1.22.23.4.2.module_el8.10.0+4358+709b81be | ALSA-2026:98113, ALSA-2026:98102, ALSA-2026:92376 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.4.2.module_el8.10.0+4358+709b81be | ALSA-2026:98113 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:98102, ALSA-2026:92376 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cockpit-image-builder | 110.3-1.el10_3 | RLSA-2026:98613 |
| Rocky Linux 10 | nodejs-nodemon | 3.1.14-5.el10_2 | RLSA-2026:96236 |
| Rocky Linux 10 | nodejs22 | 1:22.23.4-1.el10_2 | RLSA-2026:96094 |
| Rocky Linux 10 | nodejs24 | 1:24.22.1-3.el10_2 | RLSA-2026:96088 |
| Rocky Linux 9 | nodejs | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95 | RLSA-2026:92378 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+40264+d9b257bb | RLSA-2026:98522, RLSA-2026:96234, RLSA-2026:92378 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:98522, RLSA-2026:96234, RLSA-2026:96226 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:98102, RLSA-2026:92376 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:98113, RLSA-2026:98102, RLSA-2026:92376 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pi-coding-agent | 1.0.0-1.1 | openSUSE-SU-2026:11967-1 |
| openSUSE Leap 16.0 | pi-coding-agent | 1.0.4-bp160.1.1 | openSUSE-SU-2026:22111-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery +2 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.23.4-1.el10_2 | ELSA-2026-96094 |
| Oracle Linux 10 | nodejs-nodemon | 3.1.14-5.el10_2 | ELSA-2026-96236 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.9-1.22.23.4.1.el10_2 | ELSA-2026-96094 |
| Oracle Linux 9 | nodejs +4 | 1:22.23.2-2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-96234, ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 9 | npm | 1:10.9.8-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4 | ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 8 | nodejs +4 | 1:24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5 | ELSA-2026-92376 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+91054+4b1a799c | ELSA-2026-92376 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+91054+4b1a799c | ELSA-2026-92376 |
| Oracle Linux 8 | npm | 1:11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5 | ELSA-2026-92376 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5 | ELSA-2026-92376 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | lerna | 10.0.1-r6 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.9-r1 | — |
| Wolfi rolling | npm-12 | 12.2.0-r1 | — |
| Wolfi rolling | opensearch-dashboards-3 +5 | 3.8.0-r9 | — |
| Wolfi rolling | prism | 5.16.0-r14 | — |
| Wolfi rolling | rancher-api-ui | 1.2.3-r13 | — |
| Wolfi rolling | renovate | 44.133.0-r1 | — |
| Wolfi rolling | sqlpad | 7.5.7-r44 | — |
| Wolfi rolling | ts-patch | 4.0.1-r46 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | brace-expansion | >= 4.0.0, < 5.0.11 | 5.0.11 | GHSA-qhr7-859c-m2p7 |
| npm | brace-expansion | >= 3.0.0, < 3.0.8 | 3.0.8 | GHSA-qhr7-859c-m2p7 |
| npm | brace-expansion | >= 2.0.0, < 2.1.6 | 2.1.6 | GHSA-qhr7-859c-m2p7 |
| npm | brace-expansion | < 1.1.20 | 1.1.20 | GHSA-qhr7-859c-m2p7 |
Advisories 28
- RLSA-2026:98613 Critical: cockpit-image-builder security update Rocky Linux Security Advisories · Nov 13, 2026
- ALSA-2026:98102 Important: nodejs:24 security update AlmaLinux Security Advisories · Nov 13, 2026
- ALSA-2026:98113 Important: nodejs:22 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 13, 2026
- RLSA-2026:98522 Important: nodejs:26 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 12, 2026
- WID-SEC-2026-4438 Red Hat Enterprise Linux (nodejs-nodemon): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 11, 2026
- RLSA-2026:98113 Important: nodejs:22 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 11, 2026
- RLSA-2026:98102 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 11, 2026
- ELSA-2026-96234 Important: nodejs:22 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2026
- RLSA-2026:96088 Important: nodejs24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96236 Important: nodejs-nodemon security update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96094 Important: nodejs22 security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96094 Important: nodejs22 security update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96236 Important: nodejs-nodemon security update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96088 Important: nodejs24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96234 Important: nodejs:22 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- RLSA-2026:96234 Important: nodejs:22 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96226 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 10, 2026
- ELSA-2026-96094 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ELSA-2026-96236 Important: nodejs-nodemon security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ELSA-2026-96226 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- RLSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 30, 2026
- RLSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 30, 2026
- ELSA-2026-92378 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 30, 2026
- ELSA-2026-92376 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 30, 2026
- ALSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- openSUSE-SU-2026:22111-1 Security update for pi-coding-agent SUSE / openSUSE Security Updates · Oct 19, 2026
- openSUSE-SU-2026:11967-1 pi-coding-agent-1.0.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 3, 2026
References
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
- https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b
- https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c
- https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db