{"id":"CVE-2026-93687","aliases":[],"cve":{"records":[{"id":"CVE-2026-93687","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-18T14:39:01.117Z","published":"2026-09-18T15:06:02.880Z","modified":"2026-11-05T14:42:54.668Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-09-24T14:23:04.389Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-14T23:03:56.063Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-11-05T14:42:54.668Z"}],"references":[{"url":"https://github.com/micromatch/braces/issues/70","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/micromatch/braces","tags":["product"],"source":"VulnCheck"},{"url":"https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/micromatch/braces/issues/73#issuecomment-5996574974","tags":[],"source":"CVE"},{"url":"https://github.com/advisories/ghsa-vfj7-8cjw-p6xm","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-674","description":"Uncontrolled Recursion","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jonschlinkert:braces:*:*:*:*:*:node.js:*:*","versionEndIncluding":"3.0.3"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-14T23:03:49.274284Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"braces through 3.0.3 Stack Overflow via Deeply Nested Patterns","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","score":8.7,"severity":"high","published":"2026-09-18T15:06:02.880Z","modified":"2026-11-05T14:42:54.668Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"micromatch","name":"braces","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.0.3","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/braces","packageIdentity":{"ecosystem":"npm","name":"braces"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-93687"}],"remediation":[],"references":["https://github.com/micromatch/braces/issues/70","https://github.com/micromatch/braces","https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53","https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105","https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40","https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns","https://github.com/micromatch/braces/issues/73#issuecomment-5996574974","https://github.com/advisories/ghsa-vfj7-8cjw-p6xm"],"sources":[{"name":"CVE","id":"CVE-2026-93687","modified":"2026-11-05T14:42:54.668Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93687"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-05T16:17:52.639Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:10:30.655Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"braces through 3.0.3 has a stack overflow vulnerability via deeply nested patterns, allowing attackers to terminate the Node.js process. The weakness is due to uncontrolled recursion in recursive AST walkers. This can be triggered by supplying deeply nested brace patterns under the character limit.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T17:01:08.961Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93687"}]}}