Uncontrolled Recursion in Braces - CVE-2026-93687
Published: November 2, 2026
Vulnerability identifier: #VU158579
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93687
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists in the recursive AST walkers that lack depth guards. A remote attacker can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Affected software
Braces
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Automation Assets in IBM Cloud Pak for Integration (CP4I)
How to mitigate CVE-2026-93687
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.27-sc2, 4.4.4
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.2.0.5, 16.2.1.1
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.2.0.5, 16.2.1.1
External References
- https://github.com/micromatch/braces
- https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53
- https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105
- https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40
- https://github.com/micromatch/braces/issues/70
- https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns
- https://github.com/micromatch/braces/issues/73#issuecomment-5996574974