GitHub Advisoryadvisory · npm

GHSA-cwfw-4gq5-mrqx Regular Expression Denial of Service (ReDoS) in braces

LOW Published 2022-01-06 Modified 2025-11-26 Official page ↗
Aliases
CVE-2018-1109
Ecosystem
npm
Packages
braces
Severity
Low
Weaknesses
CWE-400
Reviewed
2021-03-31

Affected packages

• npm braces: >= 2.2.0, < 2.3.1 → fixed in 2.3.1

Description

A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This has been patched in version 2.3.1.

Related

Alias · CVE (1)

  • CVE-2018-1109 A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References