CVE-2026-93687

Published: Sep 18, 2026Modified: Oct 14, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (7)

https://github.com/micromatch/braces

Source: disclosure@vulncheck.com

https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53

Source: disclosure@vulncheck.com

https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105

Source: disclosure@vulncheck.com

https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40

Source: disclosure@vulncheck.com

https://github.com/micromatch/braces/issues/70

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns

Source: disclosure@vulncheck.com

https://github.com/micromatch/braces/issues/73#issuecomment-5996574974

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.