Executive brief
braces is a Node.js library that expands brace patterns, commonly used for file path matching. A stack overflow vulnerability allows attackers to crash Node.js processes by supplying deeply nested brace patterns that exhaust the call stack, causing denial of service to applications that depend on this library.
Technical details
The recursive AST walkers in braces lack depth guards, allowing attackers to craft deeply nested brace patterns that trigger unbounded recursion. An attacker can supply malicious input under character limits that still causes stack exhaustion, resulting in an uncaught RangeError that terminates the Node.js process. This is a denial-of-service vector affecting any application using the library to parse untrusted brace patterns.
Affected products
- micromatch braces through 3.0.3
Timeline
- 2026-09-18: disclosed