LowGHSA-cwfw-4gq5-mrqxCVE-2018-1109
Regular Expression Denial of Service (ReDoS) in braces
Published 6 Jan 2022 · Updated 26 Nov 2025
Affected package
bracesnpm
- Affected
- >=2.2.0 <2.3.1
- Fixed in
- 2.3.1
Update to the fixed version for your release line, for example:
npm install braces@2.3.1Details
A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This has been patched in version 2.3.1.
Is GHSA-cwfw-4gq5-mrqx in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected braces, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.