diff --git a/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json b/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json
index 701e2b6878f1..2633de7dd3c8 100644
--- a/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json
+++ b/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json
@@ -1,18 +1,14 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vfj7-8cjw-p6xm",
-  "modified": "2026-10-02T22:36:33Z",
+  "modified": "2026-10-02T22:36:34Z",
   "published": "2026-09-18T18:31:41Z",
   "aliases": [
     "CVE-2026-93687"
   ],
   "summary": "braces vulnerable to stack-exhaustion denial of service through deeply nested patterns",
-  "details": "braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.",
+  "details": "In `braces` 3.0.3, the parser limits input length to 10,000 characters but does not limit nesting depth. Deeply nested patterns can reach recursive `compile`, `expand`, and `stringify` walkers and raise `RangeError: Maximum call stack size exceeded`. An application that passes attacker-controlled patterns to these APIs can lose availability if it does not catch the error. The triggering depth depends on the Node.js runtime and call path. The character limit is not a depth guard. Until a fixed release is available, avoid untrusted patterns or enforce a conservative nesting limit before calling `braces`.",
   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
-    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
@@ -52,10 +48,18 @@
       "type": "PACKAGE",
       "url": "https://github.com/micromatch/braces"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/micromatch/braces/blob/3.0.3/index.js#L58-L128"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/constants.js#L1-L5"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105"
@@ -64,6 +68,10 @@
       "type": "WEB",
       "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/stringify.js#L22-L26"
+    },
     {
       "type": "WEB",
       "url": "https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns"