CVE-2026-93687High· 7.5▾ MidnightPoC availablebraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Nod…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
3 GitHub repos
0.4%
Last analysed / modified upstream
0.4% → 0.8%
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
braces <= 3.0.3Source: https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102278High· 7.5The brace-expansion library generates arbitrary strings containing a common prefix and suffix
CVE-2026-102276High· 7.5The brace-expansion library generates arbitrary strings containing a common prefix and suffix
CVE-2026-93450High· 7.5go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit
CVE-2026-54451High· 8.2Elixir protobuf is a pure Elixir implementation of Google Protobuf
CVE-2026-42039High· 7.5Axios is a promise based HTTP client for the browser and Node.js
CVE-2026-116144Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder