Repository navigation
fix: add maxDepth to stop deeply nested patterns overflowing the stack (CVE-2026-93687) - #86
Closed
mcris-roberto wants to merge 2 commits into
Closed
mcris-roberto wants to merge 2 commits into
mcris-roberto wants to merge 2 commits into
Conversation
…-2026-93687) Adds options.maxDepth (default 1000, cannot be raised). Deeper input throws a SyntaxError like maxLength does, instead of overflowing the recursive compile/expand/stringify walkers. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… walkers Hand-built ASTs bypass parse, so the recursive walkers now enforce the same limit (CVE-2026-93687). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Author
|
Apologies, I just saw the Issue #84: as "NOTHING TO FIX". |
6 of 10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses #70 / GHSA-vfj7-8cjw-p6xm.
Deeply nested patterns that fit inside the default
maxLength(e.g.'{'.repeat(4900) + 'a,b' + '}'.repeat(4900), about 9.8k chars) overflow the call stack in the recursivecompilewalker withRangeError: Maximum call stack size exceeded.Change
options.maxDepth(default256). It can lower the limit but not raise it above the default.SyntaxErrorwhen brace/paren nesting exceeds it, the same waymaxLengthdoes. Nothing is silently reinterpreted.compile,expandandstringifyenforce the same limit while walking, so ASTs built by hand (which never go throughparse) cannot overflow either.Tests
test/max-depth.js(new): deep balanced/unbalanced braces, deep parens, exact boundary (256 ok, 257 throws),options.maxDepth, cannot be raised, and hand-built ASTs through compile/expand/stringify. Full suite: 902 passing; the new depth tests fail without thelib/changes.Relation to existing PRs
Overlaps #78, #79 and #82, so feel free to take whichever design you prefer. In short: like #78 it throws and guards the walkers (but it adds the
maxDepthoption proposed in #77, and is smaller); like #79 it addsmaxDepthwith a 256 default (but it throws instead of keeping deeper input as literal text, and guards the walkers). It does not include #82's cycle detection or node-count cap.Known limit: the default is fixed at 256 and cannot be raised, which could break someone who legitimately nests deeper. Patterns nested that deep are not realistic, but I'm happy to change the default or make it configurable.
🤖 Generated with Claude Code