---
id: CVE-2026-93687
title: >-
  braces through 3.0.3 contains a stack overflow vulnerability in the recursive
  AST walkers that lack depth guards
summary: >-
  braces through 3.0.3 contains a stack overflow vulnerability in the recursive
  AST walkers that lack depth guards. Attackers can supply deeply nested brace
  patterns under the character limit to exhaust the call stack and terminate the
  Nod…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
  - CWE-770
vendor: micromatch
product: braces
affected:
  - braces <= 3.0.3
published: '2026-09-18'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T23:19:08.670'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93687'
references:
  - url: 'https://github.com/micromatch/braces'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/micromatch/braces/issues/70'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns
    label: disclosure@vulncheck.com
  - url: 'https://github.com/micromatch/braces/issues/73#issuecomment-5996574974'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93687.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93687'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2538197'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93687'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93687'
  - url: 'https://github.com/advisories/GHSA-vfj7-8cjw-p6xm'
tags:
  - nvd
  - exploit-available
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00757
epssPercentile: 0.54974
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/scastillo-jp/braces-fork'
    - 'https://github.com/BernydotJar/braces-security-backport'
    - 'https://github.com/canmenzo/cve-2026-93687-braces'
  checkedAt: '2026-10-27T19:23:28.663Z'
exploitAvailable: true
aliases:
  - GHSA-vfj7-8cjw-p6xm
ecosystem: npm
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-14T23:03:49.274284Z'
ingestedAt: '2026-09-18T15:44:31.587Z'
---

## Overview

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-93687)

Affected packages:

- `braces <= 3.0.3`

Source: https://github.com/advisories/GHSA-vfj7-8cjw-p6xm

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93687.json)