CVE-2026-93687
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards.
Published Sep 18, 2026 · updated Oct 14, 2026 · micromatch braces
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Sep 18, 2026 · NIST NVD
Detected
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Oct 14, 2026 · NIST NVD
Updated
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Affected
- vendor micromatch bracesversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-93687
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-93687
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-93687
30-day exploitation probability 0.8%
first.org - NIST NVDVulnerability recordCVE-2026-93687
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
nvd.nist.gov