PatchSiren

micromatch CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH micromatch CVE published 2026-09-18

CVE-2026-93687

The CVE Program has published a record for a stack overflow vulnerability in the braces package, affecting versions up to 3.0.3. The vulnerability is caused by recursive AST walkers that lack depth guards, allowing attackers to supply deeply nested brace patterns to exhaust the call stack and terminate the Node.js process. This issue can lead to a denial-of-service (DoS) and potentially allow attackers to [truncated]