CVE-2026-93687
1 advisory.
npm/braces CVE-2026-93687: high 7.5, EPSS 0.76%
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.0.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vfj7-8cjw-p6xm
- https://nvd.nist.gov/vuln/detail/CVE-2026-93687
- https://github.com/micromatch/braces/issues/70
- https://github.com/micromatch/braces
- https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53
- https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105
- https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40
- https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns
CVE-2026-93687 · published · modified · JSON