This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-93687 →
UBUNTU-CVE-2026-93687
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested b...
Original description
The description as published by the source.
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:18.04:LTS
node-braces
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
node-braces
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
node-braces
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
node-braces
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
node-braces
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
node-braces
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org
- report github.com
- report github.com
- report github.com
- report github.com
- report github.com
- report vulncheck.com