npm
CVE-2026-93687
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
- Severity
- High 7.5
- Published
- 18 Sept 2026
- Last changed
- 2 Oct 2026
- Added to UpHeron
- 16 Oct 2026
- Also known as
- GHSA-vfj7-8cjw-p6xm
- Sources
- OSV.dev and GitHub
Affected software
| Software | Affected versions |
|---|---|
bracesnpm · osv:npm:braces |
|
References
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-93687
- GitHub Advisory Database https://github.com/advisories/GHSA-vfj7-8cjw-p6xm