Is CVE-2018-1109 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-1109 being exploited in the wild.

How severe is CVE-2018-1109?

Informational severity, published 6 January 2022.

Which products and versions are affected?

braces (npm) SEMVER:introduced=2.2.0,fixed=2.3.1.

Is there a fix for CVE-2018-1109?

Yes. braces (npm): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-1109 attacked?

It is attacked over the network.

Am I affected by CVE-2018-1109?

Check whether you run braces (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-1109: braces regular expression denial of service

CVE-2018-1109 · Severity: info · Published 2022-01-06

The braces library is a Node.js utility used to expand brace patterns in strings (e.g., converting {1..3} to 1, 2, 3). A flaw in its regex handling allows an attacker to craft malicious input that causes the parser to hang or consume excessive CPU, leading to denial of service in any application using this library.

Technologies: braces (npm). Vendors: npm.

Quick answers

Is CVE-2018-1109 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-1109 being exploited in the wild.
How severe is CVE-2018-1109?: Informational severity, published 6 January 2022.
Which products and versions are affected?: braces (npm) SEMVER:introduced=2.2.0,fixed=2.3.1.
Is there a fix for CVE-2018-1109?: Yes. braces (npm): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-1109 attacked?: It is attacked over the network.
Am I affected by CVE-2018-1109?: Check whether you run braces (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

braces (npm): upgrade to 2.3.1 or later
```
npm install braces@2.3.1
```

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the braces package versions 2.2.0 through 2.3.0 due to a vulnerable regex pattern in the multiplier parser. The flaw is in lib/parsers.js, where a complex regex exhibits catastrophic backtracking when processing specially crafted brace patterns. An attacker can supply input strings containing nested or repeated brace sequences that trigger exponential regex evaluation, causing the application to hang or consume excessive CPU. The vulnerability was patched in version 2.3.1 by optimizing the regex pattern to eliminate backtracking.

Affected products

micromatch braces 2.2.0 through 2.3.0

Identifiers

CVE-2018-1109
GHSA-cwfw-4gq5-mrqx

Timeline

2022-01-06: disclosed
2.3.1: patched

References

https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.