CVE-2026-118764

UNKNOWN 0.0

minimatch: potential denial of service via globparts amplification

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

CWE	CWE-405
Vendor	isaacs
Product	minimatch
Published	Oct 29, 2026

Stay Ahead of the Next One

Get instant alerts for isaacs minimatch

Be the first to know when new unknown vulnerabilities affecting isaacs minimatch are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

isaacs / minimatch

< 11.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249 github.com: https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8 github.com: https://github.com/isaacs/minimatch/releases/tag/v11.0.1