Catalogue CVE

CVE-2026-93687

braces through 3.0.3 contains a stack overflow…

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

Gravité: High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Sep 18, 2026, 3:06:02 PM UTC
Updated: Sep 18, 2026, 4:17:15 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.76% · Oct 27, 2026

Projects and upstream resources

[node-braces][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	node-braces	Not reported	AffectedDistribution reports no fix	[CVE-2026-93687]
Debiantrixie	node-braces	`3.0.3+~3.0.5-1`	Affected	[CVE-2026-93687]
Debiansid	node-braces	Not reported	AffectedDistribution reports no fix	[CVE-2026-93687]
Debiansid	node-braces	`3.0.3+~3.0.5-1`	Affected	[CVE-2026-93687]
Debianforky	node-braces	Not reported	AffectedDistribution reports no fix	[CVE-2026-93687]
Debianforky	node-braces	`3.0.3+~3.0.5-1`	Affected	[CVE-2026-93687]
Debianbookworm	node-braces	Not reported	AffectedDistribution reports no fix	[CVE-2026-93687]
Debianbookworm	node-braces	`3.0.2+~3.0.1-1`	Affected	[CVE-2026-93687]
NpmRelease not reported	braces	Not reported	UnknownVersion impact not established	[GHSA-VFJ7-8CJW-P6XM]Oct 2, 2026, 10:36:34 PM UTC

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
NpmRelease not reported	braces	Not reported	UnknownVersion impact not established	[GHSA-VFJ7-8CJW-P6XM]Oct 2, 2026, 10:36:34 PM UTC
Debianbookworm	node-braces	Not reported	AffectedDistribution reports no fix	[CVE-2026-93687]
Debianbookworm	node-braces	`3.0.2+~3.0.1-1`	Affected	[CVE-2026-93687]
Debianforky	node-braces	Not reported	AffectedDistribution reports no fix	[CVE-2026-93687]
Debianforky	node-braces	`3.0.3+~3.0.5-1`	Affected	[CVE-2026-93687]
Debiansid	node-braces	Not reported	AffectedDistribution reports no fix	[CVE-2026-93687]
Debiansid	node-braces	`3.0.3+~3.0.5-1`	Affected	[CVE-2026-93687]
Debiantrixie	node-braces	Not reported	AffectedDistribution reports no fix	[CVE-2026-93687]
Debiantrixie	node-braces	`3.0.3+~3.0.5-1`	Affected	[CVE-2026-93687]

Original provider fields

{
  "package_releases": [
    {
      "name": "node-braces",
      "status": "vulnerable",
      "release": "sid",
      "version": "3.0.3+~3.0.5-1"
    },
    {
      "name": "node-braces",
      "status": "vulnerable",
      "release": "forky",
      "version": "3.0.3+~3.0.5-1"
    },
    {
      "name": "node-braces",
      "status": "vulnerable",
      "release": "trixie",
      "version": "3.0.3+~3.0.5-1"
    },
    {
      "name": "node-braces",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "3.0.2+~3.0.1-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1148400,
      "name": "node-braces",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1148400,
      "name": "node-braces",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1148400,
      "name": "node-braces",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1148400,
      "name": "node-braces",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "braces",
      "ecosystem": "npm",
      "provider_url": "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm",
      "fixed_version": "",
      "provider_source": "github",
      "provider_record_id": "GHSA-VFJ7-8CJW-P6XM",
      "provider_updated_at": "2026-10-02T22:36:34Z"
    }
  ]
}

[Debian bug #1148400]

Publisher notes

[trixie] node-braces: Minor issue [bookworm] node-braces: Minor issue, DoS

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

[node-braces]Inconnu
Détails (2)
- 3.0.2+~3.0.1-1 · all · bookworm
  Affectée
  nvd · node-braces · debian · bookworm
- 3.0.2+~3.0.1-1 · all · bookworm
  Affectée
  nvd · node-braces · debian · bookworm

Observé: Oct 23, 2026, 8:36:56 PM UTC

Références

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]