minimatch (npm)
a glob matcher in javascript
Advisories
52
Latest version
11.0.2
Released Oct 28, 2026
License
BlueOak-1.0.0
OpenSSF Scorecard
5.6 / 10
How to fix
Upgrading to 11.0.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install minimatch@11.0.2yarn
yarn add minimatch@11.0.2pnpm
pnpm add minimatch@11.0.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-g3hv-75wg-m249 minimatch has potential denial of service via globparts amplification |
Medium EPSS 0.29% |
< 11.0.1 | 11.0.1 |
| GHSA-g3hv-75wg-m249 minimatch has potential denial of service via globparts amplification |
Medium EPSS 0.29% |
< 11.0.1 | 11.0.1 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 4.0.0, < 4.2.5 | 4.2.5 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 5.0.0, < 5.1.8 | 5.1.8 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 6.0.0, < 6.2.2 | 6.2.2 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 7.0.0, < 7.4.8 | 7.4.8 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 8.0.0, < 8.0.6 | 8.0.6 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 9.0.0, < 9.0.7 | 9.0.7 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 10.0.0, < 10.2.3 | 10.2.3 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
< 3.1.4 | 3.1.4 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 4.0.0, < 4.2.5 | 4.2.5 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 5.0.0, < 5.1.8 | 5.1.8 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 6.0.0, < 6.2.2 | 6.2.2 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 7.0.0, < 7.4.8 | 7.4.8 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 8.0.0, < 8.0.6 | 8.0.6 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 10.0.0, < 10.2.3 | 10.2.3 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
>= 9.0.0, < 9.0.7 | 9.0.7 |
| GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
High EPSS 0.53% |
< 3.1.4 | 3.1.4 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
< 3.1.3 | 3.1.3 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 10.0.0, < 10.2.3 | 10.2.3 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 9.0.0, < 9.0.7 | 9.0.7 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 8.0.0, < 8.0.6 | 8.0.6 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 7.0.0, < 7.4.8 | 7.4.8 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 6.0.0, < 6.2.2 | 6.2.2 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 5.0.0, < 5.1.8 | 5.1.8 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 4.0.0, < 4.2.5 | 4.2.5 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
< 3.1.3 | 3.1.3 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 10.0.0, < 10.2.3 | 10.2.3 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 9.0.0, < 9.0.7 | 9.0.7 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 8.0.0, < 8.0.6 | 8.0.6 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 7.0.0, < 7.4.8 | 7.4.8 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 6.0.0, < 6.2.2 | 6.2.2 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 5.0.0, < 5.1.8 | 5.1.8 |
| GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
High EPSS 0.58% |
>= 4.0.0, < 4.2.5 | 4.2.5 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 9.0.0, < 9.0.6 | 9.0.6 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 8.0.0, < 8.0.5 | 8.0.5 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 10.0.0, < 10.2.1 | 10.2.1 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
< 3.1.3 | 3.1.3 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 4.0.0, < 4.2.4 | 4.2.4 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 5.0.0, < 5.1.7 | 5.1.7 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 6.0.0, < 6.2.1 | 6.2.1 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 7.0.0, < 7.4.7 | 7.4.7 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 8.0.0, < 8.0.5 | 8.0.5 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 9.0.0, < 9.0.6 | 9.0.6 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 10.0.0, < 10.2.1 | 10.2.1 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
< 3.1.3 | 3.1.3 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 4.0.0, < 4.2.4 | 4.2.4 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 5.0.0, < 5.1.7 | 5.1.7 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 6.0.0, < 6.2.1 | 6.2.1 |
| GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
High EPSS 0.58% |
>= 7.0.0, < 7.4.7 | 7.4.7 |
| GHSA-f8q6-p94x-37v3 minimatch ReDoS vulnerability |
High EPSS 2.28% |
< 3.0.5 | 3.0.5 |
| GHSA-hxm2-r34f-qmc5 Regular Expression Denial of Service in minimatch |
High EPSS 1.50% |
< 3.0.2 | 3.0.2 |
Source: git+ssh://git@github.com/isaacs/minimatch.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor