Skip to content
ThreatCluster

Multiple Vulnerabilities in Node.js Libraries Affect IBM Products

First seen 10 Nov 2026, 12:13 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 12:15 UTC
  • •IBM products are vulnerable due to flaws in Node.js libraries.
  • •CVE-2026-93687 and CVE-2026-90776 are among the most critical vulnerabilities.
  • •Patches have been released, but immediate application is recommended.

IBM App Connect Enterprise and QRadar SIEM products are affected by several vulnerabilities in Node.js libraries. Notably, CVE-2026-93687, a stack overflow vulnerability in the 'braces' library, could allow attackers to exhaust the call stack, leading to service termination. The CVSS score for this vulnerability is 7.5, indicating a high severity. Other vulnerabilities include CVE-2026-90776 in Nodemailer, which can cause denial of service through crafted email headers, and CVE-2026-93749, which allows for arbitrary numeric values in source maps, potentially blocking the event loop. IBM has released updates to address these vulnerabilities, but organizations using affected components are urged to apply patches promptly to mitigate risks. The vulnerabilities were disclosed between September and October 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-09-13
CVE-2026-90776 published
Nodemailer vulnerability disclosed, potentially causing denial of service through crafted email headers.
IBM
2026-09-18
CVE-2026-93687 published
The 'braces' library vulnerability was disclosed, allowing stack overflow attacks.
IBM

More articles in this cluster (2)

Following this threat?

Track CVE-2026-100699 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (37)

1 / 4

Common questions

Which IBM products are affected?
IBM App Connect Enterprise and QRadar SIEM are affected due to vulnerabilities in Node.js libraries.
What is the severity of these vulnerabilities?
The vulnerabilities have CVSS scores ranging from 7.5 to 8.7, indicating high severity.
How can we mitigate these vulnerabilities?
Apply the latest patches provided by IBM for the affected products as soon as possible.