CVE-2026-93687
braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 18, 2026
- Updated
- Oct 14, 2026
- Reserved
- Sep 18, 2026
Description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
bracesmicromatch |
|
References
- GitHub Issue #70issue-tracking
- https://github.com/micromatch/bracesproduct
- https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53technical-description
- https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105technical-description
- https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40technical-description
- VulnCheck Advisory: braces through 3.0.3 Stack Overflow via Deeply Nested Patternsthird-party-advisory
- https://github.com/micromatch/braces/issues/73#issuecomment-5996574974
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.