Vulnerability Description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/micromatch/braces
- https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53
- https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105
- https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40
- https://github.com/micromatch/braces/issues/70
- https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-dee
FAQ
What is CVE-2026-93687?
CVE-2026-93687 is a vulnerability with a CVSS score of 7.5 (HIGH). braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust...
How severe is CVE-2026-93687?
CVE-2026-93687 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93687?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.