GHSA-cwfw-4gq5-mrqx

Regular Expression Denial of Service (ReDoS) in braces

At a glance

Published: 2022-01-06 20:42 UTC
Updated: 2025-11-26 17:32 UTC
CVE: CVE-2018-1109

Description

A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This has been patched in version 2.3.1.

Affected packages

Package	Versions
npm · braces	introduced 2.2.0, fixed 2.3.1

References

https://nvd.nist.gov/vuln/detail/CVE-2018-1109 ADVISORY
https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1547272 WEB
https://snyk.io/vuln/npm:braces:20180219 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database