npm braces vulnerabilities

Latest npm braces CVEs

Newest publication first

1. CVE-2026-93687 braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

   Published 2026-09-18

   High·CVSS 8.7 EPSS 0.78%

   braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

2. CVE-2024-4068 Memory Exhaustion in braces

   Published 2024-05-13

   High·CVSS 7.5 EPSS 1.5%

   The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to s...

3. CVE-2018-1109 Regular Expression Denial of Service (ReDoS) in braces

   Published 2021-03-30

   Medium·CVSS 5.3 EPSS 1.4%

   A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.