Bundled brace-expansion@5.0.9 and undici@6.28.0 are vulnerable (fixes published 2026-09-14 / 2026-09-04) #10111

Summary

The npm CLI (verified on 11.21.0 and the latest 12.2.0) bundles two vulnerable dependencies in its own node_modules tree:

The bundled copies are reported by Trivy against container images that install npm globally, e.g.:

/usr/local/lib/node_modules/npm/node_modules/brace-expansion/package.json -> 5.0.9
/usr/local/lib/node_modules/npm/node_modules/undici/package.json -> 6.28.0

Why this is actionable now

The fixed versions were published before the current npm release, so a package-lock refresh of these two transitive deps would resolve it:

• brace-expansion 5.0.10/5.0.11/5.0.12 published 2026-09-14
• undici 6.28.1 published 2026-09-04
• npm 12.2.0 published 2026-09-30 (npm 12.1.0: 2026-09-22)

brace-expansion is bundled via minimatch@10.2.5, whose range is ^5.0.5; undici via node-gyp (range ^8.4.1 in node-gyp 13.1.0, yet the bundled tree still carries 6.28.0 — suggesting the lock is pinned/older). Detail on each:

• CVE-2026-102276 (GHSA-6j4f-fj2g-mc7p): DoS via uncontrolled recursion in parseCommaParts (stack exhaustion). CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
• CVE-2026-102278 (GHSA-qhr7-859c-m2p7): DoS via uncontrolled recursion on nested brace groups in expand_(), potentially terminating the Node process.
• CVE-2026-19534 (GHSA-rfgv-xxqx-mfg5): undici WebSocket client crashes the whole Node process during the opening handshake when a server responds with an unrequested Sec-WebSocket-Protocol subprotocol.

Reproduction

docker run --rm node:24-trixie-slim sh -c '
  npm install --global npm@12.2.0 >/dev/null 2>&1
  node -e "console.log(require(\"/usr/local/lib/node_modules/npm/node_modules/brace-expansion/package.json\").version)"
  node -e "console.log(require(\"/usr/local/lib/node_modules/npm/node_modules/undici/package.json\").version)"
'
# -> 5.0.9
# -> 6.28.0

Note that a consumer cannot work around this with npm overrides, since overrides are not honoured for global installs; the fix needs to come from the npm package itself.

Related prior reports: #9869, #9832 (earlier brace-expansion advisories).

This issue was created by an AI agent (OpenHands) on behalf of Graham Neubig.