CVE-2026-93687: braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
Published Sep 18, 2026
·Updated
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Affected Software
1 affected component
npm/braces=3.0.3
Event History
Sep 18, 2026
CVE Published
via MITRE·03:06 PM
Data Sourced
via MITRE·03:06 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker be able to do to trigger the denial of service?
An attacker must be able to supply a deeply nested brace pattern to functionality that processes patterns with braces. The pattern can remain within the character limit while still exhausting the Node.js call stack.
2
What is the operational impact of a successful exploit?
The recursive AST walkers can trigger an uncaught RangeError after the call stack is exhausted. This terminates the affected Node.js process, causing a denial of service.
3
Which versions are affected?
The issue affects braces through version 3.0.3.