CVE-2026-118764

    Dashboard / Vulnerabilities / CVE-2026-118764

    CVE-2026-118764

    Published: 29 Oct 2026Last Modified: 11 Nov 2026

    Summary: minimatch: potential denial of service via globparts amplification

    Details: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

    References: https://github.com/isaacs/minimatch/releases/tag/v11.0.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118764.json, https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249, https://nvd.nist.gov/vuln/detail/CVE-2026-118764, https://github.com/isaacs/minimatch/commit/297b6c1a01f2410b3ba1ebed14ba222d0c3c1033, https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8, https://github.com/isaacs/minimatch/commit/fd0b3ab9cbc5bf1aff1c99f1f46e413c2b3340da

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ce9e6a4b42eb8a4c39eff1258affa9d37c66101b
    Fixed -47afe882784638ccdee8d30e0b7516aed2b589a9

    Affected versions

    v11.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118764 | CVE-DB