minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade v8-12.4-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18n | Apr 16, 2026 | Apr 8, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Jun 17, 2026 | Jun 16, 2026 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs-npmUpgrade npm | Apr 22, 2026 | Feb 26, 2026 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | May 19, 2026 | Feb 26, 2026 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs22-debuginfoUpgrade nodejs-debuginfoUpgrade v8-12.4-develUpgrade nodejs-npmUpgrade nodejs22-debugsourceUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-libs-debuginfoNo solution existsUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs | Apr 9, 2026 | Feb 26, 2026 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs22-debuginfoUpgrade nodejs-debugsourceUpgrade v8-12.4-develUpgrade npm | Apr 13, 2026 | Apr 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub