Skip to content

[GHSA-vfj7-8cjw-p6xm] braces vulnerable to stack-exhaustion denial of service through deeply nested patterns #10400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jorenbroekema wants to merge 1 commit into
base: jorenbroekema/advisory-improvement-10400
Choose a base branch
from
+3 −7
Open

[GHSA-vfj7-8cjw-p6xm] braces vulnerable to stack-exhaustion denial of service through deeply nested patterns #10400

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 3 additions & 7 deletions advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vfj7-8cjw-p6xm",
"modified": "2026-10-02T22:36:33Z",
"modified": "2026-10-02T22:36:34Z",
"published": "2026-09-18T18:31:41Z",
"aliases": [
"CVE-2026-93687"
],
"summary": "braces vulnerable to stack-exhaustion denial of service through deeply nested patterns",
"details": "braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L"

@jorenbroekema jorenbroekema Oct 16, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Letting users pass regexes/regex globs unsanitized to braces is not a reasonable worst-case scenario. Avoiding this is general best practices, and not something a regex engines needs to defend itself against. That is not a reasonable ask. As the maintainer aptly put it, it's equivalent to asking javascript to defend developers against doing while (true) {}, and saying while loops are a high severity security vulnerability.

}
],
"affected": [
Expand Down Expand Up @@ -73,7 +69,7 @@
"cwe_ids": [
"CWE-674"
],
"severity": "HIGH",
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2026-10-02T22:36:33Z",
"nvd_published_at": "2026-09-18T16:17:15Z"
Expand Down
Loading