CVE-2026-93687: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
(updated )
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
References
- github.com/advisories/GHSA-vfj7-8cjw-p6xm
- github.com/micromatch/braces/blob/3.0.3/lib/compile.js
- github.com/micromatch/braces/blob/3.0.3/lib/expand.js
- github.com/micromatch/braces/blob/3.0.3/lib/parse.js
- github.com/micromatch/braces/issues/70
- nvd.nist.gov/vuln/detail/CVE-2026-93687
- www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns
Code Behaviors & Features
Detect and mitigate CVE-2026-93687 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →