REDHAT-BUG-2441268: Medium severity npm/minimatch vulnerability
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string. Each compiles to a separate [^/]? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
minimatchto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2441268?
The severity of REDHAT-BUG-2441268 is medium with a CVSS score of 4.
How do I fix REDHAT-BUG-2441268?
To fix REDHAT-BUG-2441268, update the minimatch package to version 10.2.1 or above.
What type of vulnerability is REDHAT-BUG-2441268?
REDHAT-BUG-2441268 is a Regular Expression Denial of Service (ReDoS) vulnerability.
What versions are affected in REDHAT-BUG-2441268?
Versions 10.2.0 and below of the minimatch package are affected by REDHAT-BUG-2441268.
What should I do if I cannot update to fix REDHAT-BUG-2441268?
If you cannot update, consider restricting the use of glob patterns with consecutive * wildcards followed by literal characters.