EUVD-2026-113273Published
minimatch: potential denial of service via globparts amplification
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-118764 · CVE overview and exploitation status
cve-program · CVE-2026-118764
- https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
- https://github.com/isaacs/minimatch/commit/297b6c1a01f2410b3ba1ebed14ba222d0c3c1033
- https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
- https://github.com/isaacs/minimatch/commit/fd0b3ab9cbc5bf1aff1c99f1f46e413c2b3340da
- https://github.com/isaacs/minimatch/releases/tag/v11.0.1
euvd · EUVD-2026-113273
- https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
- https://github.com/isaacs/minimatch/commit/297b6c1a01f2410b3ba1ebed14ba222d0c3c1033
- https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
- https://github.com/isaacs/minimatch/commit/fd0b3ab9cbc5bf1aff1c99f1f46e413c2b3340da
- https://github.com/isaacs/minimatch/releases/tag/v11.0.1
nvd · CVE-2026-118764
- https://github.com/isaacs/minimatch/commit/297b6c1a01f2410b3ba1ebed14ba222d0c3c1033
- https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
- https://github.com/isaacs/minimatch/commit/fd0b3ab9cbc5bf1aff1c99f1f46e413c2b3340da
- https://github.com/isaacs/minimatch/releases/tag/v11.0.1
- https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
osv · GHSA-g3hv-75wg-m249
- https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
- https://nvd.nist.gov/vuln/detail/CVE-2026-118764
- https://github.com/isaacs/minimatch/commit/297b6c1a01f2410b3ba1ebed14ba222d0c3c1033
- https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
- https://github.com/isaacs/minimatch/commit/fd0b3ab9cbc5bf1aff1c99f1f46e413c2b3340da
- https://github.com/isaacs/minimatch
- https://github.com/isaacs/minimatch/releases/tag/v11.0.1
Related changes
Linked by CVE identifier- minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repe… · Advisory content revised · 14 Nov 2026
- minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repe… · Advisory content revised · 12 Nov 2026
- minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repe… · Advisory content revised · 6 Nov 2026
- minimatch has potential denial of service via globparts amplification · Affected-version evidence changed · 4 Nov 2026
- minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repe… · Advisory content revised · 4 Nov 2026
- minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repe… · Advisory content revised · 4 Nov 2026
- minimatch: potential denial of service via globparts amplification · Affected-version evidence changed · 3 Nov 2026
- minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacke… · Advisory content revised · 1 Nov 2026
- minimatch: potential denial of service via globparts amplification · Advisory content revised · 31 Oct 2026
- minimatch has potential denial of service via globparts amplification · Newly collected advisory · 30 Oct 2026