---
id: "CVE-2026-118764"
kind: "vulnerability"
aliases: ["CVE-2026-118764"]
title: "minimatch: crafted glob pattern exhausts CPU and memory during compilation"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["build-tooling", "minimatch", "node", "npm", "package"]
not_affected_if: ["default-config", "fixed-patterns"]
published_at: "2026-10-29T17:18:07+00:00"
first_seen_at: "2026-10-29T17:26:17+00:00"
updated_at: "2026-10-29T17:27:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118764", "first_seen_at": "2026-10-29T17:26:17+00:00"}]
---

# minimatch: crafted glob pattern exhausts CPU and memory during compilation

minimatch, a JavaScript library that turns glob patterns into regular expressions, can be made to use excessive CPU and memory by a short malicious glob when optimizationLevel is 2 or higher. An attacker who controls the pattern can cause a denial of service in any process that compiles it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find minimatch in your lockfile (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`) and read the resolved version.
- Check whether your code passes untrusted input as a pattern and sets `optimizationLevel` to `2` or higher.
- Run `npm ls minimatch` to see every installed copy, including nested ones.

## Fix

- minimatch: `11.0.1`

## Timeline

- 2026-10-29T17:26:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118764

## From the sources

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_