Skip to content
Log inStart free trial

GHSA-3ppc-4f35-3m26 CVE-2026-26996

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

High npm
Severity
8.7 / 10
High · CVSS 4.0
Exploit chance (EPSS)
0.58%
Chance of exploitation in the next 30 days. Higher than 47.57% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-1333 Inefficient Regular Expression Complexity
Fix
10.2.1
Upgrade minimatch to this version or later

Description

Summary

minimatch is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits.

The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever.

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.

PoC

When minimatch compiles a glob pattern, each * becomes [^/]*? in the generated regex. For a pattern like ***************X***:

/^(?!\.)[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?X[^/]*?[^/]*?[^/]*?$/

When the test string doesn't contain X, the regex engine must try every possible way to distribute the characters across all the [^/]*? groups before concluding no match exists. With N groups and M characters, this is O(C(N+M, N)) — exponential.

Impact

Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This includes:

  • File search/filter UIs that accept glob patterns
  • .gitignore-style filtering with user-defined rules
  • Build tools that accept glob configuration
  • Any API that exposes glob matching to untrusted input

Thanks to @ljharb for back-porting the fix to legacy versions of minimatch.

Affected versions

npm

PackageVulnerableFixed in
minimatch
>= 10.0.0, < 10.2.1
10.2.1
minimatch
>= 9.0.0, < 9.0.6
9.0.6
minimatch
>= 8.0.0, < 8.0.5
8.0.5
minimatch
>= 7.0.0, < 7.4.7
7.4.7
minimatch
>= 6.0.0, < 6.2.1
6.2.1
minimatch
>= 5.0.0, < 5.1.7
5.1.7
minimatch
>= 4.0.0, < 4.2.4
4.2.4
minimatch
< 3.1.3
3.1.3
minimatch
>= 10.0.0, < 10.2.1
10.2.1
minimatch
>= 9.0.0, < 9.0.6
9.0.6
minimatch
>= 8.0.0, < 8.0.5
8.0.5
minimatch
>= 7.0.0, < 7.4.7
7.4.7
minimatch
>= 6.0.0, < 6.2.1
6.2.1
minimatch
>= 5.0.0, < 5.1.7
5.1.7
minimatch
>= 4.0.0, < 4.2.4
4.2.4
minimatch
< 3.1.3
3.1.3

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

minimatch npm → 10.2.1

npm
npm install minimatch@10.2.1
yarn
yarn add minimatch@10.2.1
pnpm
pnpm add minimatch@10.2.1

Severity breakdown

CVSS 4.0 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
None
Integrity (vulnerable system)
None
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Weakness

CWE-1333: Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

How to prevent it
  • Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
  • System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
  • Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
  • Implementation: Limit the length of the input that the regular expression will process.

References

Advisories

Fixes and patches

Packages

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-g3hv-75wg-m249
minimatch has potential denial of service via globparts amplification
Medium Also affects minimatch
GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
High Also affects minimatch
GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
High Also affects minimatch
GHSA-f8q6-p94x-37v3
minimatch ReDoS vulnerability
High Also affects minimatch
GHSA-hxm2-r34f-qmc5
Regular Expression Denial of Service in minimatch
High Also affects minimatch
GHSA-7wch-p9px-956x
Forge: Regular expression denial of service in PEM decoding (pem.decode)
High Same weakness, CWE-1333
GHSA-xcq7-p3pf-p88h
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
Medium Same weakness, CWE-1333
GHSA-xgh8-jp6q-p5x8
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
High Same weakness, CWE-1333

Credits: AkshayJainG, G-Rath, SamanthaPersico, isaacs, ljharb, thomas-schlein

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor