CVE-2026-93687 braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
Attackers can cause a Node.js process crash by supplying deeply nested brace patterns, leading to a stack overflow and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93687?
CVE-2026-93687 is a high-severity denial of service vulnerability in micromatch braces, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Weakness: CWE-674
Which versions are affected by CVE-2026-93687?
How do I fix CVE-2026-93687?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-93687 being exploited?
There is no known exploitation of CVE-2026-93687 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as AZL-103445, AZL-103481, CLEANSTART-2026-XE55341, CLSA-2026-1792230881, CLSA-2026-1792230979, CLSA-2026-1792231086 and 22 more.