minimatch has potential denial of service via globparts amplification

minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess when optimizationLevel = 2. researcher: Reid Downing b1nv0id files: - src/index.ts: 690-770 - src/index.ts: 780-796 issue: input-controlled growth of globParts during first-phase preprocessing, followed...

EUVD-2026-113273

minimatch has potential denial of service via globparts amplification...

GHSA-G3HV-75WG-M249 minimatch has potential denial of service via globparts amplification

minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess when optimizationLevel = 2. researcher: Reid Downing b1nv0id files: - src/index.ts: 690-770 - src/index.ts: 780-796 issue: input-controlled growth of globParts during first-phase preprocessing, followed...

DEBIAN-CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

CVE-2026-118764

The minimatch utility (versions prior to 11.0.1 ) is vulnerable to a Denial of Service (DoS) due to pattern amplification. In src/index.ts, the firstPhasePreProcess() function repeatedly expands attacker-controlled **/.. pattern segments within a fixpoint loop when optimizationLevel is 2 or highe...

CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

CVE-2026-118764 minimatch: potential denial of service via globparts amplification

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

CVE-2026-118764: isaacs minimatch: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

PT-2026-132401

Name of the Vulnerable Software and Affected Versions minimatch versions prior to 11.0.1 Description When optimizationLevel is set to 2 or higher, the firstPhasePreProcess function repeatedly expands attacker-controlled /.. pattern segments within a fixpoint loop. This allows generated globParts...