#532 Security exception review: braces GHSA-vfj7-8cjw-p6xm / CVE-2026-93687 (next review 2027-01-04)

[Anonymous]

Originally created by: Redo-San

Advisory

Field	Value
GHSA	GHSA-vfj7-8cjw-p6xm
CVE	CVE-2026-93687
Package	npm braces — all versions, last_affected: 3.0.3
Severity	High — CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), CWE-674
Published / GH-reviewed	2026-09-18 / 2026-10-02 (per OSV)
Fixed version	None — npm dist-tags.latest is still 3.0.3 (last modified 2024-09-18)
Upstream	[micromatch/braces#70](https://github.com/micromatch/braces/issues/70) — open, unassigned

Summary. braces bounds input character length (MAX_LENGTH = 10000) but not brace
nesting depth. The recursive AST walkers (lib/compile.js, lib/expand.js) exhaust the
call stack on deeply nested patterns (depth ≥ ~3500, within the character cap); the
uncaught RangeError: Maximum call stack size exceeded terminates the Node process
(availability impact / DoS). Attack vector: an untrusted, deeply nested brace pattern.

Why this is deferred

• No patched release exists. Every version ≤ 3.0.3 is affected; upstream has not
  shipped a fix (issue opened 2026-09-17, still open as of 2026-10-06).
• Development scope only. npm audit --omit=dev --audit-level=high exits 0 — the
  finding never reaches production. All 10 high findings in the full-scope audit share
  one root advisory (GHSA-vfj7-8cjw-p6xm) through micromatch, fast-glob,
  chokidar, findup-sync, globby, depcheck, stylelint, workbox-cli,
  repomix.
• No attacker-controlled input path. Every glob pattern that reaches braces is
  authored in this repository (tool configs and scripts); none derive from untrusted
  input, which is the documented attack vector.

Compensating controls

• Production merge gate npm run audit:prod (in ci.yml) stays always-hard and blocks
  any production high/critical on every PR.
• Weekly Security Audit workflow (security-audit.yml, cron Mon 03:00) fails on any
  high/critical without an exception row — this row is the only allowlist entry and is
  re-verified on every scheduled run.
• Scorecard Vulnerabilities check reads the matching ignore in osv-scanner.toml.
• Dependabot alerts, CodeQL and zizmor keep running; if a patched release appears, the
  exception must be removed in the same PR that bumps the dependency.

Review checklist (due 2027-01-04, within 90 days)

• [ ] npm view braces version — has a patched release landed?
• [ ] GitHub Advisory Database — has first_patched_version been set on GHSA-vfj7-8cjw-p6xm?
• [ ] If fixed: bump the overrides/lockfile entry in one PR, remove the row from
  security/vulnerability-exceptions.md, close this issue.
• [ ] If still unfixed: re-run the risk assessment and renew the row with a new
  next-review date (no auto-renewal).

References

• OSV record: https://api.osv.dev/v1/vulns/GHSA-vfj7-8cjw-p6xm
• Repo policy: security/vulnerability-exceptions.md
• Weekly gate: .github/workflows/security-audit.yml
• Scorecard ignore: osv-scanner.toml

[Anonymous]

Originally posted by: Redo-San

Scheduled workflow verified green.

• PR [#533] (merged, cc48cb1): via-chain root resolution in the gate + the deferral row for GHSA-vfj7-8cjw-p6xm in security/vulnerability-exceptions.md.
• PR [#534] (merged, 76d66e3): the Run npm audit (full scope) step no longer dies on npm's documented findings exit code 1; the report shape is validated instead, and the enforce step got the same guard as defense in depth. The 2026-10-05 failure was actually at the collect step, which prevented the policy gate from ever running.
• Manual dispatch on main: run 37456067272 — conclusion: success, both steps passed, gate log: No unexcepted high/critical advisories.

Next review stays 2027-01-04 (see the checklist in the issue body).