CVE-2018-1109
Regular Expression Denial of Service (ReDoS) in braces
A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
- Record
CVE-2018-1109- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-185, CWE-400
- Updated
- 2026-11-02
CVE List No score
A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
- Record
CVE-2018-1109- Weakness
- CWE-185
- Updated
- 2026-11-02
EUVDEUVD-2022-0569 No score
A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
- Record
EUVD-2022-0569- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cwfw-4gq5-mrqx No score
Regular Expression Denial of Service (ReDoS) in braces
A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This has been patched in version 2.3.1.
- Record
GHSA-cwfw-4gq5-mrqx- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1109
A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
- Record
UBUNTU-CVE-2018-1109- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-cwfw-4gq5-mrqx No score
Regular Expression Denial of Service (ReDoS) in braces
A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This has been patched in version 2.3.1.
- Record
GHSA-cwfw-4gq5-mrqx- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bracesnpm |
2.2.0 up to 2.3.1 | 2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1109 is a medium vulnerability (CVSS 5.3) in Braces Project Braces, published March 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in braces 2.3.1.
References
bugzilla.redhat.com/show_bug.cgi?id=1547272
snyk.io/vuln/npm:braces:20180219
nvd.nist.gov/vuln/detail/CVE-2018-1109
github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451
ubuntu.com/security/CVE-2018-1109
npmjs.com/advisories/786
cve.org/CVERecord?id=CVE-2018-1109