6.9
Moyenne
CVE-2026-118764 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects
Description
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| minimatch 7.0 | 7.0.0 → < 11.0.1 | 11.0.1 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de minimatch
Les 4 CVE de minimatch →
CVE-2026-27904
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects
7.5
Élevée
CVE-2026-27903
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects
7.5
Élevée
CVE-2026-26996
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects
8.7
Élevée