CVE-2026-93687

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93687

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93687.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93687

Downstream

Published

2026-09-18T15:06:02Z

Modified

2026-09-20T11:47:30Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

Details

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93687.json"
}

References

Affected packages

Git / github.com/micromatch/braces

Affected ranges

Type

GIT

Repo

https://github.com/micromatch/braces

Events

Introduced

Fixed

74b2db2938fad48a2ea54a9c8bf27a37a62c350d

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "3.0.3"
        },
        {
            "fixed":  "3.0.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*

0.1.4

1.*

1.1.0

1.2.0

1.3.0

1.4.0

1.5.0

1.5.1

1.7.0

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.1.0

2.1.1

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

3.*

3.0.1

3.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93687.json"