8.7

CVE-2026-93687: braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

Awaiting analysis
AliasesUBUNTU-CVE-2026-93687DEBIAN-CVE-2026-93687CGA-358h-7x5r-hrgm
Published 18-09-2026Last modified 14-10-2026

Vulnerability summary

CVE-2026-93687 is a high (CVSS 8.7) Uncontrolled Recursion vulnerability in micromatch braces. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 55.2% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 8.7 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.76%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 18-09-2026
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

CVSS metrics

11 scores · 7 sources · 2 versions

EPSS trend

Probability

0.76%

Chance of exploitation in the next 30 days

Percentile

55%

Versus all other CVEs

30-day change

Increase +0.02 pp

From 0.74% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard90 products
  • airflow-2All versions (No fix recorded) | < 2.11.2-r26
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.11All versions (No fix recorded) | < 3.11.14.6-r2
  • arangodb-3.12All versions (No fix recorded) | < 3.12.12.1-r10
  • argo-workflows-ui-3.7All versions (No fix recorded) | < 3.7.18-r13
Wolfi17 products
  • argo-workflows-ui-4.0All versions (No fix recorded) | < 4.0.15-r0
  • jupyter-base-notebook< 7.6.3-r2
  • kubeflow-pipelines-frontendAll versions (No fix recorded) | < 2.17.2-r16
  • langfuse-3-workerAll versions (No fix recorded) | < 3.225.12-r5
  • nextcloud-server-33All versions (No fix recorded) | < 33.0.10-r0
Debian1 product
  • node-bracesAll versions (No fix recorded)
Mageia1 product
  • nodejs-braces< 3.0.3-1.mga10
Micromatch1 product
Npm1 product
  • braces≤ 3.0.3
Opensuse1 product
  • terragrunt&distro=openSUSE Tumbleweed< 1.2.1-1.1
Ubuntu1 product
  • node-bracesAll versions (No fix recorded)

8 vendors · 113 products

References

16 links
Show all 16 references