Log in Start free

Vulnerability · Published Oct 29, 2026 · Assigned by GitHub_M

CVE-2026-118764minimatch: potential denial of service via globparts amplification

Medium 6.9

In plain English

A medium-severity security flaw in minimatch from isaacs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 77.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-minimatchno fix listedDEBIAN-CVE-2026-118764
Debian:13node-minimatchno fix listedDEBIAN-CVE-2026-118764
Debian:14node-minimatchno fix listedDEBIAN-CVE-2026-118764
Ubuntu:22.04:LTSnode-minimatchno fix listedUBUNTU-CVE-2026-118764
Ubuntu:24.04:LTSnode-minimatchno fix listedUBUNTU-CVE-2026-118764
Ubuntu:26.04:LTSnode-minimatchno fix listedUBUNTU-CVE-2026-118764
Ubuntu:26.10node-minimatchno fix listedUBUNTU-CVE-2026-118764
npmminimatch11.0.1GHSA-g3hv-75wg-m249

Affected products (as reported)

VendorProductVersions
isaacs minimatch >= 7.0.0, < 11.0.1

Weakness: CWE-405 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References