VYPR
← All advisories
Low severityNVD Advisory· Published Mar 30, 2021· Updated Dec 1, 2025

CVE-2018-1109

CVE-2018-1109

Description

A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Braces versions 2.2.0 to 2.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via a crafted input.

Vulnerability

Overview

CVE-2018-1109 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the Braces npm package, versions 2.2.0 through 2.3.0. The flaw resides in the lib/parsers.js file, where a regular expression used to match brace patterns can be forced into catastrophic backtracking when processing specially crafted input strings [1][3].

Exploitation

Mechanics

An attacker can trigger the vulnerability by providing a maliciously crafted string that causes the regex engine to take exponential time to evaluate. The vulnerable regex in the multiplier parser was identified and subsequently optimized in commit abdafb0cae, where the pattern was simplified to reduce the risk of backtracking [4]. No authentication or special network position is required if the application processes user-supplied brace patterns.

Impact

Successful exploitation leads to a denial of service condition, where the Node.js process becomes unresponsive or extremely slow, potentially impacting the availability of the application or service using the Braces library. This class of attack is known as ReDoS and can be used to degrade or deny service to legitimate users [2].

Mitigation and

Status

The vulnerability was patched in Braces version 2.3.1. Users should upgrade to that version or later to eliminate the risk. The Red Hat bug tracker notes this issue is closed as NOTABUG from their perspective, but the upstream fix is available and recommended [3].

References
  1. NVD - CVE-2018-1109
  2. Snyk Vulnerability Database | Snyk
  3. Regular Expression Denial of Service (ReDoS) in lib/parsers.js
  4. optimize regex · micromatch/braces@abdafb0

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
bracesnpm
>= 2.2.0, < 2.3.12.3.1

Affected products

2
  • Braces/Bracesdescription
  • ghsa-coords
    pkg:npm/braces
    Range: >= 2.2.0, < 2.3.1

Patches

1
abdafb0cae1e

optimize regex

https://github.com/micromatch/bracesjonschlinkertFeb 16, 2018via ghsa
commit
1 file changed · +1 −1
  • lib/parsers.js+1 −1 modified
    @@ -127,7 +127,7 @@ module.exports = function(braces, options) {
     .set('multiplier', function() {
       var isInside = this.isInside('brace');
       var pos = this.position();
-      var m = this.match(/^\{(,+(?:(\{,+\})*),*|,*(?:(\{,+\})*),+)\}/);
+      var m = this.match(/^\{((?:,|\{,+\})+)\}/);
       if (!m) return;
 
       this.multiplier = true;

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.