{"id":"CVE-2026-93687","aliases":["AZL-103445","AZL-103481","CLSA-2026-1792230881","CLSA-2026-1792230979","CLSA-2026-1792231086","CLSA-2026-1792231181","CLSA-2026-1792231291","CLSA-2026-1792231377","DEBIAN-CVE-2026-93687","EUVD-2026-82983","GHSA-vfj7-8cjw-p6xm","MGASA-2026-0518","ROOT-APP-NPM-CVE-2026-93687","UBUNTU-CVE-2026-93687","openSUSE-SU-2026:12352-1"],"status":"published","title":"braces through 3.0.3 Stack Overflow via Deeply Nested Patterns","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00775,"percentile":0.5608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-674"],"published":"2026-09-18T15:06:02Z","modified":"2026-11-05T21:32:25Z","exploits":[{"source":"pocgithub","id":"scastillo-jp/braces-fork","title":"scastillo-jp/braces-fork","date":"2026-09-24","url":"https://github.com/scastillo-jp/braces-fork"},{"source":"pocgithub","id":"BernydotJar/braces-security-backport","title":"BernydotJar/braces-security-backport","date":"2026-10-10","url":"https://github.com/BernydotJar/braces-security-backport"},{"source":"pocgithub","id":"canmenzo/cve-2026-93687-braces","title":"canmenzo/cve-2026-93687-braces","date":"2026-10-23","url":"https://github.com/canmenzo/cve-2026-93687-braces"}],"fixes":[{"ecosystem":"TuxCare:npm","package":"braces","fixed_in":["1.8.5-tuxcare.2","3.0.3-tuxcare.3","2.3.1-tuxcare.2","3.0.2-tuxcare.3","2.3.2-tuxcare.4","0.1.5-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"nodejs-braces","fixed_in":["3.0.3-1.mga10"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"braces","fixed_in":["3.0.3-aikido.1","3.0.2-aikido.3","2.3.2-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/braces","fixed_in":["3.0.3-root.io.1","3.0.2-root.io.3","2.3.2-root.io.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"terragrunt","fixed_in":["1.2.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.2-6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.5-tuxcare.0"},{"fixed":"1.8.5-tuxcare.2"}]}],"versions":["1.8.5","1.8.5-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.3"}]}],"versions":["3.0.3","3.0.3-tuxcare.1","3.0.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1-tuxcare.0"},{"fixed":"2.3.1-tuxcare.2"}]}],"versions":["2.3.1","2.3.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.2-tuxcare.0"},{"fixed":"3.0.2-tuxcare.3"}]}],"versions":["3.0.2","3.0.2-tuxcare.1","3.0.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.2-tuxcare.0"},{"fixed":"2.3.2-tuxcare.4"}]}],"versions":["2.3.2","2.3.2-tuxcare.1","2.3.2-tuxcare.2","2.3.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5-tuxcare.0"},{"fixed":"0.1.5-tuxcare.2"}]}],"versions":["0.1.5","0.1.5-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2+~3.0.1-1","3.0.3+~3.0.4-1","3.0.3+~3.0.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+~3.0.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+~3.0.5-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"nodejs-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-1.mga10"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-aikido.1"},{"fixed":"3.0.2-aikido.3"},{"fixed":"2.3.2-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-root.io.1"},{"fixed":"3.0.2-root.io.3"},{"fixed":"2.3.2-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2-1","2.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2+~3.0.0-1","3.0.2+~3.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2+~3.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+~3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+~3.0.5-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"terragrunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.1"}]}]}],"products":[{"vendor":"micromatch","product":"braces"}],"references":[{"url":"https://github.com/micromatch/braces/issues/70","tags":["issue-tracking","report","web"]},{"url":"https://github.com/micromatch/braces","tags":["product","package","report"]},{"url":"https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53","tags":["technical-description","article","web","report"]},{"url":"https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105","tags":["technical-description","article","web","report"]},{"url":"https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40","tags":["technical-description","article","web","report"]},{"url":"https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns","tags":["third-party-advisory","advisory","web","report"]},{"url":"https://github.com/micromatch/braces/issues/73#issuecomment-5996574974","tags":["report","web"]},{"url":"https://github.com/advisories/ghsa-vfj7-8cjw-p6xm","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93687","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vfj7-8cjw-p6xm"},{"url":"https://www.npmjs.com/package/braces","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93687.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93687","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0518.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93687","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-93687","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93687","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-93687","title":"braces through 3.0.3 Stack Overflow via Deeply Nested Patterns","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"published","published":"2026-09-18T15:06:02.88Z","modified":"2026-11-05T14:42:54.668Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-05T16:36:34.343037Z"}],"euvd":[{"id":"EUVD-2026-82983","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"published","published":"2026-09-18T15:06:02Z","modified":"2026-11-05T14:42:54Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-05T16:59:57.067043Z"}],"ghsa":[{"id":"GHSA-vfj7-8cjw-p6xm","title":"Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns","description":"### Withdrawn Advisory\nThis advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.\n\n### Original Description\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"withdrawn","published":"2026-09-18T18:31:41Z","modified":"2026-10-23T12:53:05Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:41:35.723785Z"}],"nvd":[{"id":"CVE-2026-93687","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"published","published":"2026-09-18T16:17:15.507Z","modified":"2026-11-05T15:17:27.113Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-05T19:56:00.556424Z"}],"osv":[{"id":"CVE-2026-93687","title":"braces through 3.0.3 Stack Overflow via Deeply Nested Patterns","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"published","published":"2026-09-18T15:06:02.88Z","modified":"2026-11-07T02:30:25.509933556Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-07T03:08:12.44191Z"},{"id":"DEBIAN-CVE-2026-93687","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"published","published":"2026-09-18T16:17:15.507Z","modified":"2026-10-15T09:47:42.567542393Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"GHSA-vfj7-8cjw-p6xm","title":"Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns","description":"### Withdrawn Advisory\nThis advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.\n\n### Original Description\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"withdrawn","published":"2026-09-18T18:31:41Z","modified":"2026-10-23T13:00:05.439194928Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"UBUNTU-CVE-2026-93687","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"published","published":"2026-09-18T16:17:00Z","modified":"2026-10-17T13:01:18.366518819Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"AZL-103445","title":"CVE-2026-93687 affecting package nodejs-nodemon 2.0.3-5","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"published","published":"2026-09-18T16:17:15Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.528763Z"},{"id":"AZL-103481","title":"CVE-2026-93687 affecting package python-tensorboard 2.16.2-6","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","status":"published","published":"2026-09-18T16:17:15Z","modified":"2026-09-28T05:39:54Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"CLSA-2026-1792230881","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 1.8.5-tuxcare.2.","status":"published","published":"2026-10-17T09:54:41Z","modified":"2026-10-17T13:09:25.839444035Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792230979","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 3.0.3-tuxcare.3.","status":"published","published":"2026-10-17T09:56:19Z","modified":"2026-10-17T13:09:25.89149428Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792231086","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 2.3.1-tuxcare.2.","status":"published","published":"2026-10-17T09:58:06Z","modified":"2026-10-17T13:09:28.311963395Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792231181","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 3.0.2-tuxcare.3.","status":"published","published":"2026-10-17T09:59:41Z","modified":"2026-10-17T13:09:26.186384032Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792231291","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 2.3.2-tuxcare.4.","status":"published","published":"2026-10-17T10:01:31Z","modified":"2026-10-17T13:09:29.420921694Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792231377","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 0.1.5-tuxcare.2.","status":"published","published":"2026-10-17T10:02:57Z","modified":"2026-10-17T13:09:29.423538522Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"MGASA-2026-0518","title":"Updated nodejs-braces package fixes a security vulnerability","description":"It was discovered that braces through 3.0.3 contains a stack overflow\nvulnerability in the recursive AST walkers that lack depth guards\n(CVE-2026-93687).\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:30:03.209695565Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12352-1","title":"terragrunt-1.2.1-1.1 on GA media","description":"These are all security issues fixed in the terragrunt-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:07.592166281Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-APP-NPM-CVE-2026-93687","title":"CVE-2026-93687 in braces - Patched by Root","description":"Root has patched CVE-2026-93687 in the braces package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-12T10:25:46Z","modified":"2026-10-12T11:15:04.541217207Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}