braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-93687 · Microsoft / collected KEV context

EUVD-2026-82983

GHSA-vfj7-8cjw-p6xm

cve-program · CVE-2026-93687

• https://github.com/micromatch/braces/issues/70
• https://github.com/micromatch/braces
• https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53
• https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105
• https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40
• https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns

euvd · EUVD-2026-82983

• https://github.com/micromatch/braces/issues/70
• https://github.com/micromatch/braces
• https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53
• https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105
• https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40
• https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns

nvd · CVE-2026-93687

• https://github.com/micromatch/braces
• https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53
• https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105
• https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40
• https://github.com/micromatch/braces/issues/70
• https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns
• https://github.com/advisories/ghsa-vfj7-8cjw-p6xm
• https://github.com/micromatch/braces/issues/73#issuecomment-5996574974

osv · GHSA-vfj7-8cjw-p6xm

• https://nvd.nist.gov/vuln/detail/CVE-2026-93687
• https://github.com/micromatch/braces/issues/70
• https://github.com/micromatch/braces/issues/73#issuecomment-5996574974
• https://github.com/micromatch/braces
• https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53
• https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105
• https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40
• https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns

• braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.j… · Advisory content revised · 6 Nov 2026