Live › vulnerability › CVE-2026-93687
Go to dashboardThe npm package braces through 3.0.3 has recursive AST walkers with no depth limit, so a deeply nested brace pattern can overflow the call stack. An attacker who can supply such a pattern can crash the Node.js process with an uncaught RangeError.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| braces | npm | <= 3.0.3 | – |
npm ls braces to see which versions are installed and whether braces is a dependency of something you useUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
This page as .md · .json · in your agent: get_signal("CVE-2026-93687")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.