From f2f745ff44fafd08c8e8880e7cb7d9b89a09dec2 Mon Sep 17 00:00:00 2001
From: Victor Robles Nesteanu <vnesteanu@nestdigital.ca>
Date: Sun, 4 Oct 2026 13:54:57 -0400
Subject: [PATCH] Improve GHSA-vfj7-8cjw-p6xm

---
 .../GHSA-vfj7-8cjw-p6xm.json                  | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json b/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json
index 701e2b6878f1..2633de7dd3c8 100644
--- a/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json
+++ b/advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json
@@ -1,18 +1,14 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vfj7-8cjw-p6xm",
-  "modified": "2026-10-02T22:36:33Z",
+  "modified": "2026-10-02T22:36:34Z",
   "published": "2026-09-18T18:31:41Z",
   "aliases": [
     "CVE-2026-93687"
   ],
   "summary": "braces vulnerable to stack-exhaustion denial of service through deeply nested patterns",
-  "details": "braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.",
+  "details": "In `braces` 3.0.3, the parser limits input length to 10,000 characters but does not limit nesting depth. Deeply nested patterns can reach recursive `compile`, `expand`, and `stringify` walkers and raise `RangeError: Maximum call stack size exceeded`. An application that passes attacker-controlled patterns to these APIs can lose availability if it does not catch the error. The triggering depth depends on the Node.js runtime and call path. The character limit is not a depth guard. Until a fixed release is available, avoid untrusted patterns or enforce a conservative nesting limit before calling `braces`.",
   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
-    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
@@ -52,10 +48,18 @@
       "type": "PACKAGE",
       "url": "https://github.com/micromatch/braces"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/micromatch/braces/blob/3.0.3/index.js#L58-L128"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/constants.js#L1-L5"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105"
@@ -64,6 +68,10 @@
       "type": "WEB",
       "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/micromatch/braces/blob/3.0.3/lib/stringify.js#L22-L26"
+    },
     {
       "type": "WEB",
       "url": "https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns"