Read the docs
TI-2022-03245 Aliases CVE-2022-3517GHSA-f8q6-p94x-37v3

Uncontrolled resource consumption in minimatch

Priority MEDIUM 43CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 11 fixed, 32 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02279 83rd percentileScored 2026-11-07
Fix Partial minimatch (npm): 3.0.5Red Hat: 15 advisoriesRed Hat: 11 fixed, 32 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—minimatchminimatch versions prior to 3.0.5—No fix listedCNA
—minimatch (npm)before 3.0.53.0.5Patch availableGHSA-f8q6-p94x-37v3
  • minimatch Vendor— Affected minimatch versions prior to 3.0.5 Fixed in — No fix listed CNA
  • minimatch (npm) Vendor— Affected before 3.0.5 Fixed in 3.0.5 Patch available GHSA-f8q6-p94x-37v3

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*before 3.0.5VulnerableMinimatch Project
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:* Versions before 3.0.5 Vulnerable ·Minimatch Project
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-f8q6-p94x-37v3 minimatch (npm) Fixed in 3.0.5 Advisory →

Red Hat 15 advisories

  • RHSA-2025:19094 Released 2025-10-23 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.24.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +4
  • RHSA-2025:11814 Released 2025-07-28 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.19 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator
  • RHSA-2023:3742 Released 2023-06-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
Show 12 more Red Hat advisories
  • RHSA-2023:1742 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x::nodejs:14 +19
  • RHSA-2023:1743 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x::nodejs:14 +19
  • RHSA-2023:1533 Released 2023-03-30 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x::nodejs:14 +19
  • RHSA-2023:0612 Released 2023-02-06 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
  • RHSA-2023:0471 Released 2023-01-26 · Red Hat rating Important
    Migration Toolkit for Runtimes security update
    • Migration Toolkit for Runtimes 1 on RHEL 8
  • RHSA-2023:0321 Released 2023-01-23 · Red Hat rating Moderate
    nodejs and nodejs-nodemon security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.18.1-3.el9_1, nodejs-docs-1:16.18.1-3.el9_1, nodejs-full-i18n-1:16.18.1-3.el9_1 +3
  • RHSA-2023:0050 Released 2023-01-09 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x::nodejs:14 +19
  • RHSA-2022:9073 Released 2022-12-15 · Red Hat rating Moderate
    nodejs:16 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x::nodejs:16 +19
  • RHSA-2022:9047 Released 2022-12-15 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.6 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-hook-runner-rhel8, rhmtc/openshift-migration-legacy-rhel8-operator +14
  • RHSA-2022:9040 Released 2022-12-14 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.6.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
  • RHSA-2022:8833 Released 2022-12-06 · Red Hat rating Moderate
    nodejs:18 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64::nodejs:18, nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le::nodejs:18, nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x::nodejs:18 +20
  • RHSA-2022:8832 Released 2022-12-06 · Red Hat rating Moderate
    nodejs:18 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64::nodejs:18, nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le::nodejs:18, nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x::nodejs:18 +20

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix yet: Fix deferred
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.0AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Directory Server 11AffectedNo fix planned: Will not fix
Red Hat Directory Server 12AffectedNo fix planned: Will not fix
Red Hat Discovery 1AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix planned: Will not fix
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
8Base-RHMTC-1.7Fixed RHSA-2022:9047
Migration Toolkit for Runtimes 1 on RHEL 8Fixed RHSA-2023:0471
RHODF 4.13 for RHEL 9Fixed RHSA-2023:3742
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:8833, RHSA-2022:9073, RHSA-2023:0050, RHSA-2023:1743
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:8832, RHSA-2023:0321
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:1533
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:1742
Red Hat OpenShift Dev Spaces (RHOSDS) 3.24Fixed RHSA-2025:19094
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2025:11814
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:0612
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:0612
Not affected: 16 products
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Service Mesh 2.1
  • RHODF 4.13 for RHEL 9
  • Red Hat A-MQ Online
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 3
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24
  • Red Hat OpenShift Virtualization 4
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Data Foundation 4.19

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3517
  2. 2026-10-03 Alias added: GHSA-f8q6-p94x-37v3

References

Patch 2

Advisory 4

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences