CVE-2026-93687

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/micromatch/braces
https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53
https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105
https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40
https://github.com/micromatch/braces/issues/70
https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns
https://github.com/micromatch/braces/issues/73#issuecomment-5996574974

Configurations

No configuration.

History

12 Oct 2026, 07:16

Type	Values Removed	Values Added
References		() https://github.com/micromatch/braces/issues/73#issuecomment-5996574974 -

18 Sep 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-18 16:17

Updated : 2026-10-14 23:19

NVD link : CVE-2026-93687

Mitre link : CVE-2026-93687

CVE.ORG link : CVE-2026-93687

JSON object : View

Products Affected

No product.

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-93687", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93687", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T23:03:49.274284Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/micromatch/braces", "vendor": "micromatch", "product": "braces", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.3"}], "packageURL": "pkg:npm/braces", "collectionURL": "https://www.npmjs.com/package/braces", "defaultStatus": "unaffected"}]}], "published": "2026-09-18T16:17:15.507", "references": [{"url": "https://github.com/micromatch/braces", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/micromatch/braces/issues/70", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/micromatch/braces/issues/73#issuecomment-5996574974", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError."}], "lastModified": "2026-10-14T23:19:08.670", "sourceIdentifier": "disclosure@vulncheck.com"}