CVEvulnerability
CVE-2026-93687
8.7 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-09-18
- Last modified
- 2026-10-14
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-674
Description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Related
Weakness · CWE (1)
- CWE-674 Uncontrolled Recursion weakness
References
- https://github.com/micromatch/braces github.com
- https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53 github.com
- https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105 github.com
- https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40 github.com
- https://github.com/micromatch/braces/issues/70 github.com
- https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns www.vulncheck.com
- https://github.com/micromatch/braces/issues/73#issuecomment-5996574974 github.com