braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth
    guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call
    stack and terminate the Node.js process with an uncaught RangeError. (CVE-2026-93687)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth     guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call     stack and terminate the Node.js process with an uncaught RangeError. (CVE-2026-93687)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473511	Chainguard: tensorflow-gpu-jupyter: security update to 2.21.0-r12	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
473511	Chainguard: tensorflow-gpu-jupyter: security update to 2.21.0-r12	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
472081	SCA: security update for braces (GHSA-vfj7-8cjw-p6xm)	Tenable Cloud Security	SCA Checks	Local	high
472081	SCA: security update for braces (GHSA-vfj7-8cjw-p6xm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
348638	Linux Distros Unpatched Vulnerability : CVE-2026-93687	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-93687

high

Tenable Plugins

high

high

high

high

high