CVE-2018-1109

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-185 CWE-400

Affected software

Vendor	Product	Versions
n/a	nodejs-braces	>= 2.2.0, < 2.3.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=1547272Issue Tracking, Patch, Third Party Advisory
https://snyk.io/vuln/npm:braces:20180219Exploit, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1547272Issue Tracking, Patch, Third Party Advisory
https://snyk.io/vuln/npm:braces:20180219Exploit, Third Party Advisory

Timeline

Published: Mar 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-110906.1An XSS issue was discovered in MyBiz MyProcureNet 5.0.0. This vulnerability within "ProxyPage.aspx" allows an attacker to inject malicious c CVE-2018-110919.9An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an CVE-2018-110926.5An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/inde CVE-2018-110936.1Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web sc CVE-2018-110949.8An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /gofor CVE-2018-110958.8The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the CVE-2018-110966.5Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account infor CVE-2018-110977.5An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a program crash.CVE-2018-110987.2An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar is CVE-2018-110995.5The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-base CVE-2018-11107.5A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service.CVE-2018-111008.8The decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than