High severity7.5NVD Advisory· Published Sep 18, 2026· Updated Oct 14, 2026
CVE-2026-93687
CVE-2026-93687
Description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
bracesnpm | <= 3.0.3 | — |
Affected products
1- Range: <=3.0.3
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-vfj7-8cjw-p6xmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-93687ghsaADVISORY
- github.com/micromatch/braces/blob/3.0.3/lib/compile.jsnvdWEB
- github.com/micromatch/braces/blob/3.0.3/lib/expand.jsnvdWEB
- github.com/micromatch/braces/blob/3.0.3/lib/parse.jsnvdWEB
- github.com/micromatch/braces/issues/70nvdWEB
- github.com/micromatch/braces/issues/73nvdWEB
- www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patternsnvdWEB
News mentions
0No linked articles in our index yet.