---
id: CVE-2026-93687
title: >-
  braces through 3.0.3 contains a stack overflow vulnerability in the recursive
  AST walkers that lack depth guards
summary: >-
  braces through 3.0.3 contains a stack overflow vulnerability in the recursive
  AST walkers that lack depth guards. Attackers can supply deeply nested brace
  patterns under the character limit to exhaust the call stack and terminate the
  Nod…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
  - CWE-770
vendor: micromatch
product: braces
affected:
  - braces <= 3.0.3
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:25:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93687'
references:
  - url: 'https://github.com/micromatch/braces'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/micromatch/braces/issues/70'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93687.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93687'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2538197'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93687'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93687'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
epss: 0.00415
epssPercentile: 0.35523
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-18T16:56:10.796872Z'
ingestedAt: '2026-09-18T15:44:31.587Z'
---

## Overview

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93687.json)