Fluid Attacks Database

Description

braces vulnerable to stack-exhaustion denial of service through deeply nested patterns braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 12	node-braces	=3.0.2+~3.0.1-1 \|\| =3.0.3+~3.0.4-1 \|\| =3.0.3+~3.0.5-1
debian 13	node-braces	=3.0.3+~3.0.5-1
debian 14	node-braces	=3.0.3+~3.0.5-1
npm	braces	>=0 <=3.0.3

Aliases

1. CVE-2026-936872. NVD-2026-936873. OSV-DEBIAN-2026-936874. OSV-2026-936875. GCVE-2026-936876. SECURITY-TRACKER-CVE-2026-93687

References

1. https://github.com/scastillo-jp/braces-fork2. https://github.com/micromatch/braces/issues/703. https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L534. https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L1055. https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L406. https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.