CVE-2026-118764: minimatch: potential denial of service via globparts amplification
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
minimatchto a version that resolves this vulnerability.Fixed in 11.0.1
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using minimatch before 11.0.1 are exposed when they compile attacker-controlled glob patterns with optimizationLevel set to 2 or higher. The affected software entry is debian/node-minimatch.
What does an attacker need to exploit the issue?
An attacker needs to supply a malicious glob containing **/.. pattern segments. No authentication or user interaction is required according to the provided severity vector.
What is the impact of a successful attack?
A short crafted glob can trigger repeated expansion and pairwise processing during pattern compilation, causing excessive CPU and memory consumption. This can result in denial of service.
What is the available fix?
Upgrade minimatch to version 11.0.1, which fixes the preprocessing behavior that permits globParts amplification.