{"id":"CVE-2026-118764","aliases":["GHSA-g3hv-75wg-m249"],"title":"minimatch has potential denial of service via globparts amplification","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.\n\nresearcher: Reid Downing (b1nv0id)\nfiles: \n\n- src/index.ts: 690-770\n- src/index.ts: 780-796\n\nissue:\ninput-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.\n\nthe **/../ transformation clones a globparts entry and appends the clone to the same globparts array:\n```\nparts.splice(gs, 1)\nconst other = parts.slice(0)\nother[gs] = '**'\nglobParts.push(other)\n```\nthis occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.\n\nthe expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:\n```\nfor (let i = 0; i < globParts.length - 1; i++) {\n  for (let j = i + 1; j < globParts.length; j++) {\n    this.partsMatch(...)\n  }\n}\n```\nan attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.","severity":"medium","score":6.9,"published":"2026-10-29T17:07:11.357Z","modified":"2026-10-30T23:15:07.420Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"minimatch","sources":[{"name":"OSV · GHSA-g3hv-75wg-m249","url":"https://osv.dev/vulnerability/GHSA-g3hv-75wg-m249"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"11.0.1"}],"type":"SEMVER"}],"versions":[],"fixed":["11.0.1"]}],"sourceAffected":[],"references":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"sources":[{"name":"OSV","id":"GHSA-g3hv-75wg-m249","modified":"2026-10-30T23:15:07.420159385Z","url":"https://osv.dev/vulnerability/GHSA-g3hv-75wg-m249"},{"name":"CVE","id":"CVE-2026-118764","modified":"2026-10-30T23:09:45.690Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118764"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9},{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9}],"cve":{"records":[{"id":"CVE-2026-118764","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T19:20:05.017Z","published":"2026-10-29T17:07:11.357Z","modified":"2026-10-30T23:09:45.690Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T23:09:45.690Z"}],"references":[{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/isaacs/minimatch/releases/tag/v11.0.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-405","description":"CWE-405: Asymmetric Resource Consumption (Amplification)","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"isaacs","name":"minimatch","platforms":[],"versions":[{"version":"< 11.0.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-118764"}],"remediation":[],"observedAt":"2026-10-31T00:35:13.003Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:05:32.453Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T17:35:35.534Z","attemptedAt":"2026-10-29T17:35:35.534Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T17:35:35.824Z","attemptedAt":"2026-10-29T17:35:35.824Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T17:35:37.069Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T17:35:35.166Z","attemptedAt":"2026-10-29T17:35:35.166Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","modified":"2026-10-29T17:18:07.380","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-29T17:35:35.534Z"}],"aiSummary":{"text":"minimatch versions less than 11.0.1 may be vulnerable to denial of service via glob pattern amplification, potentially causing excessive CPU and memory consumption. An attacker with access to supply a glob pattern can exploit this weakness. The impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T01:01:55.561Z","sources":[{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-g3hv-75wg-m249"},{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118764"}]}}