{"id":"CVE-2026-93687","kind":"vulnerability","aliases":["CVE-2026-93687","GHSA-vfj7-8cjw-p6xm"],"related":[],"title":"Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns","description":"### Withdrawn Advisory\nThis advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.\n\n### Original Description\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.","summary":"The npm package braces through 3.0.3 has recursive AST walkers with no depth limit, so a deeply nested brace pattern can overflow the call stack. An attacker who can supply such a pattern can crash the Node.js process with an uncaught RangeError.","severity":"high","cvss":8.7,"epss":0.007569999899715185,"exploited":false,"exploited_at":null,"products":[{"name":"braces","fixed":[],"affected":"<= 3.0.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["braces","cwe-674","node.js","npm","package"],"not_affected_if":["braces-not-installed","no-untrusted-brace-patterns","withdrawn-advisory"],"how_to_check":"Run npm ls braces to see which versions are installed and whether braces is a dependency of something you use.\nThe advisory was withdrawn by its publisher as not practically exploitable, so treat this as low priority unless the pattern comes from untrusted input.","fix":null,"status":"withdrawn","published_at":"2026-09-18T16:17:15+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T21:45:35+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:45:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","impact":"low","summary":"The npm package braces through 3.0.3 has recursive AST walkers with no depth limit, so a deeply nested brace pattern can overflow the call stack. An attacker who can supply such a pattern can crash the Node.js process with an uncaught RangeError.","category":"package","who_cares":["npm","node.js","braces"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes the Node.js process by supplying deeply nested brace patterns","analyst_note":"","how_to_check":"Run npm ls braces to see which versions are installed and whether braces is a dependency of something you use.\nThe advisory was withdrawn by its publisher as not practically exploitable, so treat this as low priority unless the pattern comes from untrusted input.","needs_analyst":false,"not_affected_if":["withdrawn-advisory","no-untrusted-brace-patterns","braces-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000479,"input_tokens":2904,"output_tokens":377,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A '-674':30B '-93687':18A,26A '3.0.3':39B,103C '8cjw':22A 'advisori':2A,77C,79C 'ast':42B,112C 'attack':60B,118C 'brace':3A,28B,37B,52B,101C,123C 'braces':27A 'call':57B,132C 'charact':127C 'contain':104C 'crash':68B 'cve':16A,24A 'cwe':29B 'deepli':13A,50B,121C 'denial':9A 'depth':46B,116C 'descript':100C 'exhaust':8A,130C 'exploit':89C 'extern':97C 'ghsa':20A 'ghsa-vfj7-8cjw-p6xm':19A 'guard':117C 'lack':115C 'limit':47B,128C 'link':92C 'maintain':94C 'nest':14A,51B,122C 'node.js':31B,70B,137C 'npm':32B,35B 'origin':99C 'overflow':55B,107C 'p6xm':23A 'packag':33B,36B 'pattern':15A,53B,66B,124C 'practic':88C 'preserv':96C 'process':71B,138C 'rangeerror':75B,142C 'recurs':41B,111C 'refer':98C 'servic':11A 'stack':7A,58B,106C,133C 'stack-exhaust':6A 'suppli':63B,120C 'termin':135C 'uncaught':74B,141C 'vfj7':21A 'vulner':4A,90C,108C 'walker':43B,113C 'withdrawn':1A,76C,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-18T16:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vfj7-8cjw-p6xm","url":"https://github.com/advisories/GHSA-vfj7-8cjw-p6xm","severity":"high","published_at":"2026-09-18T18:31:41+00:00","modified_at":"2026-10-23T12:53:05+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-93687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93687","severity":null,"published_at":"2026-09-18T16:17:15+00:00","modified_at":"2026-10-14T23:19:08+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}