What’s Vulnerable › Vulnerabilities

CVE-2026-93687: braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-10-14
• Weakness: CWE-674

Description

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Affected products

• micromatch braces: through 3.0.3

References

• https://github.com/micromatch/braces
• https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53
• https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105
• https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40
• https://github.com/micromatch/braces/issues/70
• https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns
• https://github.com/micromatch/braces/issues/73#issuecomment-5996574974

Get alerted when CVE-2026-93687 or the next vulnerability affects your stack