Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel = 2. researcher: Reid Downing (b1nv0id) files: - src/index.ts: 690-770 - src/index.ts: 780-796 issue: input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing. the /../ transformation clones a globparts entry and appends the clone to the same globparts array: this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again. the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons: an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
Recommended action: Upgrade to 11.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.4.88.0.64.2.53.1.35.1.810.2.36.2.29.0.7· Vendor fix available
Issue
matchOne() performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where n is the number of path segments and k is the number of globstars. With k=11 and n=30, a call to the default minimatch() API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. --- Details The vulnerable loop is in matchOne() at src/index.ts#L960: When a GLOBSTAR is encountered, the function tries to match the remaining pattern against every suffix of the remaining file segments. Each multiplies the number of recursive calls by the number of remaining segments. With k non-adjacent globstars and n file segments, the total number of calls is C(n, k). There is no depth counter, visited-state cache, or budget limit applied to this recursion. The call tree is fully explored before returning false on…
Recommended action: Upgrade to 10.2.3, 9.0.7, 8.0.6 or 5 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.4.88.0.64.2.55.1.810.2.33.1.46.2.29.0.7· Vendor fix available
Issue
Nested () extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b))), which exhibit catastrophic backtracking in V8. With a 12-byte pattern (((a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. --- Details The root cause is in AST.toRegExpSource() at src/ast.ts#L598. For the extglob type, the close token emitted is ) or )?, wrapping the recursive body in (?:...). When extglobs are nested, each level adds another quantifier around the previous group: This produces the following regexps: | Pattern | Generated regex | |----------------------|------------------------------------------| | (a\|b) | /^(?:a\|b)$/ | | ((a\|b)) | /^(?:(?:a\|b))$/ | | (((a\|b))) |…
Recommended action: Upgrade to 10.2.3, 9.0.7, 8.0.6 or 5 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
6.2.13.1.34.2.410.2.18.0.59.0.67.4.75.1.7· Vendor fix available
Issue
minimatch is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string. Each compiles to a separate [^/]? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. PoC When minimatch compiles a glob pattern, each becomes [^/]? in the generated regex. For a pattern like X: When the test string doesn't contain X, the regex engine must try every possible way to distribute the characters across all the [^/]? groups before concluding no match exists. With N groups and M characters, this is O(C(N+M, N)) — exponential.…
Recommended action: Upgrade to 10.2.1, 9.0.6, 8.0.5 or 5 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Recommended action: Upgrade to 3.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern). Proof of Concept Recommendation Update to version 3.0.2 or later.
Recommended action: Upgrade to 3.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.