High severity7.5NVD Advisory· Published Sep 18, 2026· Updated Sep 18, 2026
CVE-2026-93687
CVE-2026-93687
Description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=3.0.3
Patches
Vulnerability mechanics
References
5- github.com/micromatch/braces/blob/3.0.3/lib/compile.jsnvd
- github.com/micromatch/braces/blob/3.0.3/lib/expand.jsnvd
- github.com/micromatch/braces/blob/3.0.3/lib/parse.jsnvd
- github.com/micromatch/braces/issues/70nvd
- www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patternsnvd
News mentions
0No linked articles in our index yet.