GHSA-vfj7-8cjw-p6xm CVE-2026-93687
Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
- Severity
- 8.7 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.76%
- Chance of exploitation in the next 30 days. Higher than 55.19% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-674 Uncontrolled Recursion
- Fix
- None yet
- No fixed version published
Description
Withdrawn Advisory
This advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.
Original Description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Affected versions
npm
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How to prevent it
- Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- Implementation: Increase the stack size.
References
Advisories
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-grv7-fg5c-xmjg Uncontrolled resource consumption in braces | High | Also affects braces |
| GHSA-cwfw-4gq5-mrqx Regular Expression Denial of Service (ReDoS) in braces | Medium | Also affects braces |
| GHSA-hqq3-7jhf-c5jx Forge: Denial of service in TLS record processing via call stack exhaustion | High | Same weakness, CWE-674 |
| GHSA-wwpr-jff3-395c Crass: A large number of adjacent CSS comments can trigger a SystemStackError | Medium | Same weakness, CWE-674 |
| GHSA-6jxj-px6v-747w Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage | Medium | Same weakness, CWE-674 |
| GHSA-vvm8-gf78-28g4 Go JOSE: Panics in JSON parsing | Medium | Same weakness, CWE-674 |
| EEF-CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types | Not rated yet | Same weakness, CWE-674 |
| GHSA-c9rx-x947-fp3h ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) | Medium | Same weakness, CWE-674 |
Credits: VicRobNes, ericcornelissen, naveensharmatech
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor