Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨High - braces DoS via Recursive AST Walker Stack Overflow (CVE-2026-93687) braces <= 3.0.3 recursively walks nested brace AST nodes without enforcing a max recursion depth. A crafted deeply nested brace pattern (within input limits) triggers call stack exhaustion and an uncaught RangeError, terminating the Node.js process (DoS). 👉Affected: braces <= 3.0.3