{"id":"CVE-2018-1109","aliases":["EUVD-2022-0569","GHSA-cwfw-4gq5-mrqx","UBUNTU-CVE-2018-1109"],"status":"published","title":"Regular Expression Denial of Service (ReDoS) in braces","description":"A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01389,"percentile":0.7247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-185","CWE-400"],"published":"2021-03-30T01:52:55Z","modified":"2026-06-17T01:50:29Z","fixes":[{"ecosystem":"npm","package":"braces","fixed_in":["2.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.3.1"}]}]},{"source":"osv","ecosystem":"npm","package":"braces","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.3.1"}]}]}],"products":[{"vendor":"braces_project","product":"braces"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1547272","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://snyk.io/vuln/npm:braces:20180219","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1109","tags":["advisory"]},{"url":"https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-cwfw-4gq5-mrqx"},{"url":"https://ubuntu.com/security/CVE-2018-1109","tags":["report"]},{"url":"https://www.npmjs.com/advisories/786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1109","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-1109","description":"A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.","status":"published","published":"2021-03-30T01:52:55Z","modified":"2025-12-01T14:18:10.499Z","cwes":["CWE-185"],"updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2022-0569","description":"A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.","status":"published","published":"2021-03-30T01:52:55Z","modified":"2025-12-01T14:18:10Z","updated_at":"2026-11-02T19:49:11.947161Z"}],"ghsa":[{"id":"GHSA-cwfw-4gq5-mrqx","title":"Regular Expression Denial of Service (ReDoS) in braces","description":"A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This has been patched in version 2.3.1.","status":"published","published":"2022-01-06T20:42:03Z","modified":"2025-11-26T16:25:52Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:10.178331Z"}],"nvd":[{"id":"CVE-2018-1109","description":"A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.","status":"published","published":"2021-03-30T02:15:14.673Z","modified":"2026-06-17T01:50:29.887Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-185","CWE-400"],"updated_at":"2026-11-02T14:05:00.565712Z"}],"osv":[{"id":"UBUNTU-CVE-2018-1109","description":"A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.","status":"withdrawn","published":"2021-03-30T02:15:00Z","modified":"2025-07-17T16:53:44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"GHSA-cwfw-4gq5-mrqx","title":"Regular Expression Denial of Service (ReDoS) in braces","description":"A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This has been patched in version 2.3.1.","status":"published","published":"2022-01-06T20:42:03Z","modified":"2025-11-26T17:32:10.727937Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:45.639885Z"}]}}