CVE-2026-93687: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

[SeriousJul]

https://github.com/SeriousJul/seriousjul.github.io/security/dependabot/57

Package: braces
Ecosystem: npm
Vulnerable range: <= 3.0.3
Severity: high
CVSS score: 7.5

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

[SeriousJul]

No patched version exists: dependency replaced, not upgraded

CVE-2026-93687 (GHSA-vfj7-8cjw-p6xm) covers braces <= 3.0.3 with first_patched_version: null. Verified against the registry and upstream on 2026-10-06:

• npm view braces dist-tags → latest is 3.0.3, the last version in the vulnerable range. No 3.0.4 or later has been published.
• Upstream tag list ends at 3.0.3; issue Security Advisory: Uncontrolled Recursion Depth in Tree Walkers Leads to Stack-Overflow DoS micromatch/braces#70 is still open.

So there is nothing to bump to. Per the alert workflow, the dependency is replaced: a vendored copy of 3.0.3 plus depth guards lives at vendor/braces/ (version declared 3.0.4, outside the vulnerable range) and is wired in through the root manifest:

"dependencies": { "braces": "file:vendor/braces" },
"overrides":    { "braces": "$braces" }

The override is what reaches the two transitive consumers: chokidar (~3.0.2, webpack file watching) and micromatch (^3.0.3, glob matching). The lockfile now resolves node_modules/braces to the vendored copy; the registry entry is gone.

The vulnerability, reproduced

The recursive AST walkers (compile, expand, stringify) have no depth guard; the only input limit is 10000 characters, which still allows 4999 nesting levels. Measured on Node 20 (the CI runtime): braces.compile on a 4999-deep parenthesised pattern (9999 chars, under the limit) dies with an uncaught RangeError: Maximum call stack size exceeded. On Node 26 the default stack is deeper and the same pattern survives, so the crash is platform dependent until the library bounds the depth itself.

What the vendored copy changes (see vendor/braces/PATCH-NOTES.md)

• MAX_DEPTH: 100 in lib/constants.js.
• lib/parse.js counts total nesting (braces and parentheses) and throws a catchable RangeError past the cap, mirroring the existing maxLength guard. options.maxDepth can only lower the cap.
• The three recursive walkers carry a depth argument and throw the same guard, covering the direct-AST entry points (braces.compile(ast), .expand(ast), .stringify(ast)) that bypass the parser.
• 4000 randomized patterns (depth <= 4) across all four APIs produce byte-identical output to unpatched 3.0.3.

Verification

• tests/braces-security.test.mjs (new, 12 tests): pins the lockfile replacement outside <= 3.0.3 and asserts the guard fires at depth 101 with a bounded, catchable error instead of stack exhaustion, including a no-catch child-process probe shaped like the real chokidar/micromatch call sites.
• Full suite: 75/75 pass (Node 26 and Node 20). npm run typecheck passes. npm run build (the Docusaurus production build, which drives webpack/chokidar/micromatch through the vendored copy) succeeds. npm ci from the committed lockfile resolves braces 3.0.4.

When upstream publishes a fix

Delete vendor/braces/ and the overrides/dependencies.braces entries, run npm install to restore the registry copy, and drop the now-stale test expectations if the message changes.

[SeriousJul]

PR Review: CVE-2026-93687 braces stack-exhaustion fix

Verified on Node 26 (CI uses Node 20): npm ci, npm test (75/75 pass, including the 13 braces tests), and npm run build all succeed. The installed node_modules/braces is a link to vendor/braces, so chokidar and micromatch both resolve the patched copy.

Verification performed

• Diffed vendor/braces against the real braces@3.0.3 tarball. The only changes are the depth guards, the MAX_DEPTH constant, and the version bump. The console.log in lib/compile.js is upstream 3.0.3 original code, not introduced here.

• Confirmed the advisory is real and lists no fixed version, which justifies the vendored copy.

• Ran the no-catch child-process probe (4999-deep parens, 9999 chars): the process dies with the catchable guard RangeError, not with Maximum call stack size exceeded.

• Confirmed ordinary patterns produce byte-identical output to 3.0.3 behavior, and depth 100 is accepted while 101 is rejected.

• Score: 92 / 100

• Specification Check: Pass

  • Lockfile resolves braces to exactly one entry (vendor/braces, 3.0.4, outside the vulnerable range <= 3.0.3); no registry copy remains.
  • Both transitive consumers (chokidar ~3.0.2, micromatch ^3.0.3) are satisfied by 3.0.4, so a reinstall cannot roll the fix back.
  • All four recursive entry points are guarded: parse (nesting of braces and parens) and the compile, expand, stringify AST walkers (which bypass parse when given an AST directly).
  • Failure mode is now a catchable RangeError thrown at depth 101 on any Node version, independent of call stack headroom.
  • Regression test is wired into the existing npm test script and pins the behavior the vendored copy must keep.

• Quality Check: Pass

  • The patch is minimal and surgical: guards only, mirroring the existing maxLength guard. options.maxDepth can be lowered but never raised above the hard cap.
  • PATCH-NOTES.md documents the reason, the exact delta, and the removal path when upstream ships a fix.
  • The test suite is strong: it checks lockfile uniqueness, manifest override, dependent range satisfaction, boundary depth, direct AST entry points, and reads the error message rather than only checking "it threw".

• Required Changes: (none blocking; two minor notes)

  • PATCH-NOTES.md says the rest of package.json is "verbatim from the published 3.0.3 tarball", but the vendored copy also drops scripts, devDependencies, and verb fields. Harmless, arguably cleaner, but the note should say so.
  • Consider a short comment in vendor/braces/lib/compile.js (or in PATCH-NOTES.md) flagging the inherited upstream console.log('node.isClose', ...) line, so a future maintainer does not mistake it for local debug code or "fix" it silently.