minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade v8-12.4-develUpgrade nodejsUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-libs | Apr 16, 2026 | Apr 8, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Jun 17, 2026 | Jun 16, 2026 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-npm | Apr 22, 2026 | Feb 26, 2026 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | May 19, 2026 | Feb 26, 2026 |
| Redhat_linux | — | Upgrade nodejsNo solution existsUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs22-debugsourceUpgrade nodejs-npmUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npmUpgrade v8-12.4-devel | Apr 9, 2026 | Feb 26, 2026 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs22-debuginfoUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade npm | Apr 13, 2026 | Apr 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub