CVE-2026-93687: braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Other sources
braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the denial of service?
An attacker must be able to supply a deeply nested brace pattern to functionality that processes patterns with braces. The pattern can remain within the character limit while still exhausting the Node.js call stack.
What is the operational impact of a successful exploit?
The recursive AST walkers can trigger an uncaught RangeError after the call stack is exhausted. This terminates the affected Node.js process, causing a denial of service.
Which versions are affected?
The issue affects braces through version 3.0.3.