Every CVE Search/ Get API key

CVE-2026-93687

braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

8.7 HighPublic exploitFix available

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.78%Up 0.4 points since Sep 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
CVE-2026-93687
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674
Updated
2026-11-05
EUVDEUVD-2026-82983 8.7

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
EUVD-2026-82983
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-vfj7-8cjw-p6xm 8.7

Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

Withdrawn Advisory

This advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.

Original Description

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
GHSA-vfj7-8cjw-p6xm
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
NVD 8.7

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
CVE-2026-93687
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674
Updated
2026-11-05
OSV 8.7

braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
CVE-2026-93687
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-674
Updated
2026-11-07
OSVDEBIAN-CVE-2026-93687 8.7

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
DEBIAN-CVE-2026-93687
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 13 moreShow less
OSVGHSA-vfj7-8cjw-p6xm 8.7

Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

Withdrawn Advisory

This advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.

Original Description

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
GHSA-vfj7-8cjw-p6xm
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
OSVUBUNTU-CVE-2026-93687 8.7

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
UBUNTU-CVE-2026-93687
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-103445 No score

CVE-2026-93687 affecting package nodejs-nodemon 2.0.3-5

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
AZL-103445
Updated
2026-11-05
OSVAZL-103481 No score

CVE-2026-93687 affecting package python-tensorboard 2.16.2-6

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Record
AZL-103481
Updated
2026-11-02
OSVCLSA-2026-1792230881 No score

TuxCare security update for braces (1 CVE)

TuxCare rebuilt braces to address 1 CVE. Fixed in 1.8.5-tuxcare.2.

Record
CLSA-2026-1792230881
Updated
2026-11-02
OSVCLSA-2026-1792230979 No score

TuxCare security update for braces (1 CVE)

TuxCare rebuilt braces to address 1 CVE. Fixed in 3.0.3-tuxcare.3.

Record
CLSA-2026-1792230979
Updated
2026-11-02
OSVCLSA-2026-1792231086 No score

TuxCare security update for braces (1 CVE)

TuxCare rebuilt braces to address 1 CVE. Fixed in 2.3.1-tuxcare.2.

Record
CLSA-2026-1792231086
Updated
2026-11-02
OSVCLSA-2026-1792231181 No score

TuxCare security update for braces (1 CVE)

TuxCare rebuilt braces to address 1 CVE. Fixed in 3.0.2-tuxcare.3.

Record
CLSA-2026-1792231181
Updated
2026-11-02
OSVCLSA-2026-1792231291 No score

TuxCare security update for braces (1 CVE)

TuxCare rebuilt braces to address 1 CVE. Fixed in 2.3.2-tuxcare.4.

Record
CLSA-2026-1792231291
Updated
2026-11-02
OSVCLSA-2026-1792231377 No score

TuxCare security update for braces (1 CVE)

TuxCare rebuilt braces to address 1 CVE. Fixed in 0.1.5-tuxcare.2.

Record
CLSA-2026-1792231377
Updated
2026-11-02
OSVMGASA-2026-0518 No score

Updated nodejs-braces package fixes a security vulnerability

It was discovered that braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards (CVE-2026-93687).

Record
MGASA-2026-0518
Updated
2026-11-02
OSVopenSUSE-SU-2026:12352-1 No score

terragrunt-1.2.1-1.1 on GA media

These are all security issues fixed in the terragrunt-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12352-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-93687 No score

CVE-2026-93687 in braces - Patched by Root

Root has patched CVE-2026-93687 in the braces package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-93687
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs-nodemon
Azure Linux:3
 through 2.0.3-5 None known
python-tensorboard
Azure Linux:3
 through 2.16.2-6 None known
braces
TuxCare:npm
 1.8.5-tuxcare.0 up to 1.8.5-tuxcare.2, plus listed versions
1.8.51.8.5-tuxcare.1
1.8.5-tuxcare.2
braces
TuxCare:npm
 3.0.3-tuxcare.0 up to 3.0.3-tuxcare.3, plus listed versions
3.0.33.0.3-tuxcare.13.0.3-tuxcare.2
3.0.3-tuxcare.3
braces
TuxCare:npm
 2.3.1-tuxcare.0 up to 2.3.1-tuxcare.2, plus listed versions
2.3.12.3.1-tuxcare.1
2.3.1-tuxcare.2
braces
TuxCare:npm
 3.0.2-tuxcare.0 up to 3.0.2-tuxcare.3, plus listed versions
3.0.23.0.2-tuxcare.13.0.2-tuxcare.2
3.0.2-tuxcare.3
braces
TuxCare:npm
 2.3.2-tuxcare.0 up to 2.3.2-tuxcare.4, plus listed versions
2.3.22.3.2-tuxcare.12.3.2-tuxcare.22.3.2-tuxcare.3
2.3.2-tuxcare.4
braces
TuxCare:npm
 0.1.5-tuxcare.0 up to 0.1.5-tuxcare.2, plus listed versions
0.1.50.1.5-tuxcare.1
0.1.5-tuxcare.2
node-braces
Debian:12
 All versions, plus listed versions
3.0.2+~3.0.1-13.0.3+~3.0.4-13.0.3+~3.0.5-1
 None known
node-braces
Debian:13
 All versions, plus listed versions
3.0.3+~3.0.5-1
 None known
Show 11 moreShow less
Affected packages
PackageAffectedFixed
node-braces
Debian:14
 All versions, plus listed versions
3.0.3+~3.0.5-1
 None known
nodejs-braces
Mageia:10
 before 3.0.3-1.mga10
3.0.3-1.mga10
braces
Root:npm
 before 3.0.3-aikido.1
3.0.3-aikido.13.0.2-aikido.32.3.2-aikido.3
@rootio/braces
Root:npm
 before 3.0.3-root.io.1
3.0.3-root.io.13.0.2-root.io.32.3.2-root.io.3
node-braces
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.2-12.0.2-2
 None known
node-braces
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.0.2-2
 None known
node-braces
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.0.2+~3.0.0-13.0.2+~3.0.1-1
 None known
node-braces
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.0.2+~3.0.1-1
 None known
node-braces
Ubuntu:26.10
 All versions, plus listed versions
3.0.3+~3.0.5-1
 None known
node-braces
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.0.3+~3.0.5-1
 None known
terragrunt
openSUSE:Tumbleweed
 before 1.2.1-1.1
1.2.1-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubscastillo-jp/braces-fork2026-09-24
PoC in GitHubBernydotJar/braces-security-backport2026-10-10
PoC in GitHubcanmenzo/cve-2026-93687-braces2026-10-23

History

History
RecordedChangedSources
referencesNVD, OSV
exploits, facts, referencesCVE List, EUVD, OSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-93687 is a high vulnerability (CVSS 8.7) in Micromatch Braces, published September 18, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 55th percentile. Fixed in braces 1.8.5-tuxcare.2.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open