CVE-2026-93687CWE-674

CVE-2026-93687

High · published September 18, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00757 · 54.7th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-18T20:17Z
References (7)
https://github.com/micromatch/braces · [email protected]https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53 · [email protected]https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105 · [email protected]https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40 · [email protected]https://github.com/micromatch/braces/issues/70 · [email protected]https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns · [email protected]https://github.com/micromatch/braces/issues/73#issuecomment-5996574974 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 15:06Z
    braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
    cvelistv5