GHSA-vfj7-8cjw-p6xm

Suggest an improvement
Source
https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vfj7-8cjw-p6xm
Aliases
Downstream
CGA (259)
MINI (15)
Withdrawn
2026-10-23T12:53:02Z
Published
2026-09-18T18:31:41Z
Modified
2026-10-23T13:00:05Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
Details

Withdrawn Advisory

This advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.

Original Description

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Database specific 
{
    "cwe_ids":  [
        "CWE-674"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-02T22:36:33Z",
    "nvd_published_at":  "2026-09-18T16:17:15Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / braces

Package

Name
braces
View open source insights on deps.dev
Purl
pkg:npm/braces

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
3.0.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json"