# CVE-2018-1109: braces regular expression denial of service

Source: https://junglewise.ai/threats/cve-2018-1109-braces-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-1109 · Severity: info · Published 2022-01-06

The braces library is a Node.js utility used to expand brace patterns in strings (e.g., converting {1..3} to 1, 2, 3). A flaw in its regex handling allows an attacker to craft malicious input that causes the parser to hang or consume excessive CPU, leading to denial of service in any application using this library.

Technologies: [braces (npm)](https://junglewise.ai/threats/technologies/braces). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-1109 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-1109 being exploited in the wild.

**How severe is CVE-2018-1109?** Informational severity, published 6 January 2022.

**Which products and versions are affected?** braces (npm) SEMVER:introduced=2.2.0,fixed=2.3.1.

**Is there a fix for CVE-2018-1109?** Yes. braces (npm): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-1109 attacked?** It is attacked over the network.

**Am I affected by CVE-2018-1109?** Check whether you run braces (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- braces (npm): upgrade to 2.3.1 or later

  ```sh
  npm install braces@2.3.1
  ```


## Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the braces package versions 2.2.0 through 2.3.0 due to a vulnerable regex pattern in the multiplier parser. The flaw is in lib/parsers.js, where a complex regex exhibits catastrophic backtracking when processing specially crafted brace patterns. An attacker can supply input strings containing nested or repeated brace sequences that trigger exponential regex evaluation, causing the application to hang or consume excessive CPU. The vulnerability was patched in version 2.3.1 by optimizing the regex pattern to eliminate backtracking.

## Affected products

- micromatch braces 2.2.0 through 2.3.0

## Identifiers

- CVE-2018-1109
- GHSA-cwfw-4gq5-mrqx

## Timeline

- 2022-01-06: disclosed
- 2.3.1: patched

## References

- [https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451](https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451)

## Related threats

- [braces stack overflow in recursive AST walkers](https://junglewise.ai/threats/cve-2026-93687-braces-through-3-0-3-contains-a-stack-overflow-vulnerability-in)
- [braces uncontrolled resource consumption](https://junglewise.ai/threats/cve-2024-4068-braces-uncontrolled-resource-consumption)
- [braces regular expression denial of service](https://junglewise.ai/threats/braces-regular-expression-denial-of-service-b7ef8e21)