[pkg-vuln] CVE-2026-118764 in minimatch@3.1.5 #1426

New Issue

kert · 2026-10-31T04:07:48Z

kert commented

2026-10-31 04:07:48 +00:00

Severity: MEDIUM
Package: minimatch @ 3.1.5
Fixed in: 11.0.1

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memo

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-118764

**Severity:** MEDIUM **Package:** `minimatch` @ `3.1.5` **Fixed in:** `11.0.1` minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memo **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-118764

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-31 04:07:48 +00:00

kert added the ci quality labels 2026-10-31 04:07:48 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1426