medium6.9
CVE-2026-118764
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
Impact
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | minimatch | < 11.0.1 | 11.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Isaacs | Minimatch | before 11.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-g3hv-75wg-m249
- https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
- https://nvd.nist.gov/vuln/detail/CVE-2026-118764
- https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
- https://github.com/isaacs/minimatch/releases/tag/v11.0.1