{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.0.3"}],"component":"braces","cve_ids":["CVE-2026-93687"],"ecosystem":"npm","epss":0.00775,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vfj7-8cjw-p6xm","id":"tcs_01M5KGBPP69AT6CJK41VMGKG0Q","modified_at":"2026-10-02T22:45:04.328737432Z","published_at":"2026-09-18T18:31:41Z","references":["https://osv.dev/vulnerability/GHSA-vfj7-8cjw-p6xm","https://nvd.nist.gov/vuln/detail/CVE-2026-93687","https://github.com/micromatch/braces/issues/70","https://github.com/micromatch/braces","https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53","https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105","https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40","https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-vfj7-8cjw-p6xm","url":"https://osv.dev/vulnerability/GHSA-vfj7-8cjw-p6xm"}],"summary":"braces vulnerable to stack-exhaustion denial of service through deeply nested patterns"}