---
id: "CVE-2026-93687"
kind: "vulnerability"
aliases: ["CVE-2026-93687", "GHSA-vfj7-8cjw-p6xm"]
title: "Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns"
severity: "high"
cvss: 8.7
epss: 0.007569999899715185
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "braces", "fixed": [], "affected": "<= 3.0.3", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["braces", "cwe-674", "node.js", "npm", "package"]
not_affected_if: ["braces-not-installed", "no-untrusted-brace-patterns", "withdrawn-advisory"]
published_at: "2026-09-18T16:17:15+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93687", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

The npm package braces through 3.0.3 has recursive AST walkers with no depth limit, so a deeply nested brace pattern can overflow the call stack. An attacker who can supply such a pattern can crash the Node.js process with an uncaught RangeError.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:braces affected <= 3.0.3 fixed ?

## How to check

Run npm ls braces to see which versions are installed and whether braces is a dependency of something you use.
The advisory was withdrawn by its publisher as not practically exploitable, so treat this as low priority unless the pattern comes from untrusted input.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93687

## From the sources

### Withdrawn Advisory
This advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.

### Original Description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_