Live › vulnerability › CVE-2026-118764
minimatch, a JavaScript library that turns glob patterns into regular expressions, can be made to use excessive CPU and memory by a short malicious glob when optimizationLevel is 2 or higher. An attacker who controls the pattern can cause a denial of service in any process that compiles it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 17:26 UTC. All times on this page are UTC.
Applications that pass attacker-influenced glob patterns to minimatch with optimizationLevel 2 or higher are exposed, and build tools or servers that match user-supplied paths are the likely case. Projects that use only fixed, developer-written patterns, or the default optimization level, can skip it.
No product ranges from the sources yet.
package-lock.json, pnpm-lock.yaml, yarn.lock) and read the resolved version.optimizationLevel to 2 or higher.npm ls minimatch to see every installed copy, including nested ones.11.0.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118764")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.