CVE-2026-93687: Stack Exhaustion Denial of Service in braces Package
Summary
CVE-2026-93687: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns. Affects braces versions < 3.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The braces package is a widely used utility in the npm ecosystem that provides functionality for parsing and manipulating brace patterns in strings. It is commonly utilized in various JavaScript applications to handle complex string patterns efficiently. However, versions prior to 3.0.4 are vulnerable to a stack overflow issue due to the lack of depth guards in its recursive AST walkers, making it susceptible to denial of service attacks through deeply nested brace patterns.
Vulnerability Detail
The vulnerability in the braces package arises from its recursive AST walkers that do not implement depth guards, allowing attackers to exploit this weakness by supplying deeply nested brace patterns. This can lead to a stack overflow, causing the Node.js process to terminate unexpectedly with an uncaught RangeError. The implications of this vulnerability are significant, as it can lead to service disruptions and denial of service, impacting the availability of applications that rely on the braces package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the depth of brace patterns processed by your application or implement input validation to reject overly complex patterns that may lead to stack exhaustion.
Conclusion
The braces package has a critical vulnerability that can lead to stack exhaustion and denial of service. It is essential to update to version 3.0.4 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your applications effectively.
See every vulnerability recorded for braces →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions of the braces package from 0.0.0 up to 3.0.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help you identify if your application is affected by this vulnerability.
If left unaddressed, this vulnerability can lead to denial of service, causing your application to crash and become unavailable to users.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for braces.
