UBUNTU-CVE-2026-93687

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-93687

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93687.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-93687

Upstream

CVE-2026-93687

Published

2026-09-21T00:00:00Z

Modified

2026-09-21T21:40:59Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

References

Affected packages

Ubuntu:18.04:LTS / node-braces

Package

Name: node-braces
Purl: pkg:deb/ubuntu/node-braces?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.2-1

2.0.2-2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-braces",
            "binary_version":  "2.0.2-2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93687.json"

Ubuntu:20.04:LTS / node-braces

Package

Name: node-braces
Purl: pkg:deb/ubuntu/node-braces?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.2-2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-braces",
            "binary_version":  "3.0.2-2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93687.json"

Ubuntu:22.04:LTS / node-braces

Package

Name: node-braces
Purl: pkg:deb/ubuntu/node-braces?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.2+~3.0.0-1

3.0.2+~3.0.1-1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-braces",
            "binary_version":  "3.0.2+~3.0.1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93687.json"

Ubuntu:24.04:LTS / node-braces

Package

Name: node-braces
Purl: pkg:deb/ubuntu/node-braces?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.2+~3.0.1-1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-braces",
            "binary_version":  "3.0.2+~3.0.1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93687.json"

Ubuntu:26.04:LTS / node-braces

Package

Name: node-braces
Purl: pkg:deb/ubuntu/node-braces?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.3+~3.0.5-1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-braces",
            "binary_version":  "3.0.3+~3.0.5-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93687.json"