CVE-2018-1109

What it actually does

Braces versions before 2.3.1 contain a regular expression denial-of-service weakness. When the library processes specially crafted brace-expansion input, vulnerable regular expression handling can trigger excessive backtracking and consume CPU for an extended period. The flaw is remotely triggerable if an application passes attacker-controlled strings into Braces directly or through a dependent package. The primary impact is reduced availability; the issue does not directly provide code execution, data disclosure, or privilege escalation.

Why it matters to the business

Applications or build/service components that use vulnerable Braces versions can become slow or unavailable when exposed to malicious input. Because Braces is a widely used JavaScript dependency that may be included transitively, organizations may be exposed even when they do not directly import it. The CVSS score is moderate and the EPSS probability is low, and it is not in the CISA KEV catalog, but public exploit knowledge exists, so internet-facing services that process user-supplied patterns should be prioritized for review.

How an attack unfolds

An attacker first identifies an application endpoint, API, CLI service, automation workflow, or server-side feature that accepts user-controlled text and eventually passes that text to the vulnerable Braces package. The attacker then submits a crafted brace/glob-style pattern designed to trigger inefficient regular expression evaluation. On a vulnerable version, parsing the input can monopolize the Node.js event loop or consume high CPU, delaying or blocking normal request handling. By repeating the request or targeting concurrent workers, the attacker can degrade service availability or cause timeouts without needing authentication if the vulnerable parsing path is reachable anonymously.

How to fix it

Upgrade Braces to version 2.3.1 or later wherever it appears, including transitive dependency instances. Because no fixed version list was supplied in the input, use package manager tooling to resolve to a non-vulnerable release and confirm the installed version is at least 2.3.1. For npm/yarn/pnpm projects, update lockfiles, rebuild artifacts or containers, and redeploy. If immediate upgrade is not possible, reduce exposure by validating and length-limiting user-supplied pattern input, rejecting nested or excessively complex brace/glob expressions, applying request timeouts and rate limits, and isolating pattern-processing work from latency-sensitive application threads.

How to confirm the fix worked

Confirm exposure by checking dependency manifests and lockfiles for Braces versions below 2.3.1, including transitive dependencies. Useful commands include `npm ls braces`, `yarn why braces`, `pnpm why braces`, and software composition analysis scans. Validate remediation by ensuring runtime packages and built artifacts no longer contain vulnerable versions, not just source manifests. For applications that accept user-controlled patterns, perform controlled negative testing in a non-production environment with oversized or highly nested brace patterns and verify CPU usage and request latency remain bounded. Confirm that input validation, rate limiting, and request timeout controls are active where relevant.

Typical attack path

1. Identify an application feature that accepts user-controlled patterns, file globs, templates, search filters, paths, or similar strings.
2. Determine or infer that the application uses Braces before version 2.3.1 directly or through a transitive dependency.
3. Send a specially crafted brace-expansion string that triggers catastrophic regular expression backtracking.
4. Observe elevated CPU usage, request latency, worker saturation, or timeouts.
5. Repeat requests or parallelize traffic to sustain degraded availability.

How to detect it

Detection should focus on evidence of denial-of-service behavior around endpoints or jobs that parse user-controlled patterns. Review web access logs, API gateway logs, application logs, Node.js process metrics, container metrics, APM traces, and load balancer timeout logs for bursts of requests containing unusually long, nested, or repetitive brace/glob-like strings followed by high CPU, elevated event-loop lag, increased response time, 5xx errors, 408/499/504 responses, or worker restarts. In application logs, look for parsing operations involving Braces, glob expansion, file matching, template expansion, or path pattern handling that coincide with latency spikes. Since this vulnerability does not create a unique file, process, registry key, or network beacon, attribution depends on correlating suspicious input patterns with resource exhaustion and service degradation.

• package-lock.json contains "braces" with "version": "2.3.0"
• package-lock.json contains "braces" with "version": "2.2.
• package-lock.json contains "braces" with "version": "2.1.
• package-lock.json contains "braces" with "version": "2.0.
• yarn.lock contains braces@2.3.0
• yarn.lock contains braces@2.2.
• yarn.lock contains braces@2.1.
• yarn.lock contains braces@2.0.
• node_modules/braces/package.json contains "version": "2.3.0"
• node_modules/braces/package.json contains "version": "2.2.
• node_modules/braces/package.json contains "version": "2.1.
• node_modules/braces/package.json contains "version": "2.0.

What your security team should do

• Inventory all JavaScript/Node.js applications and build pipelines for Braces versions prior to 2.3.1, including transitive dependency paths.
• Prioritize remediation for internet-facing services, APIs, and automation endpoints that process user-controlled glob, brace, path, or template-like input.
• Upgrade Braces to 2.3.1 or later and regenerate lockfiles and deployed artifacts.
• Add input length and complexity limits for any feature that accepts brace/glob-style patterns from users.
• Deploy rate limiting, request timeouts, and resource monitoring to reduce the impact of repeated ReDoS attempts.
• Review historical application and infrastructure logs for unusual bursts of slow requests, high CPU, event-loop blocking, or timeout errors associated with pattern-processing endpoints.