Amplification in minimatch lets crafted globs exhaust CPU and memory
Priority LOW 36CWE-405Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 1 fixed, 48 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
minimatch, the npm package that converts glob expressions into JavaScript RegExp objects, is affected from 7.0.0 before 11.0.1. Its pattern preprocessing repeatedly expands attacker-controlled **/.. segments and then compares the expanded entries pairwise (CWE-405). An unauthenticated attacker can send a short malicious glob to cause excessive CPU and memory consumption during pattern compilation.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 23rd percentileScored 2026-11-07
Fix Partial minimatch (isaacs): 11.0.1minimatch (npm): 11.0.1Red Hat: 3 advisoriesRed Hat: 1 fixed, 48 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| isaacs | minimatch | 7.0.0 to before 11.0.1 | 11.0.1 | Patch available | CNA |
| — | minimatch (npm) | 7.0.0 to before 11.0.1 | 11.0.1 | Patch available | GHSA-g3hv-75wg-m249 |
- minimatch Vendorisaacs Affected 7.0.0 to before 11.0.1 Fixed in 11.0.1 Patch available CNA
- minimatch (npm) Vendor— Affected 7.0.0 to before 11.0.1 Fixed in 11.0.1 Patch available GHSA-g3hv-75wg-m249
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:*:*:* | — | — | Minimatch Project |
- cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:*:*:* Versions — — ·Minimatch Project
Remediation
Update the minimatch npm package to version 11.0.1. Red Hat fixes Red Hat Hardened Images in RHSA-2026:93602, RHSA-2026:93603 and RHSA-2026:93600. The sources list no fixed version for Cost Management On Premise, Cryostat 4, Exploit Intelligence, Migration Toolkit for Applications 8, Migration Toolkit for Containers and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA minimatch (isaacs) Fixed in 11.0.1
- Fix · GHSA-g3hv-75wg-m249 minimatch (npm) Fixed in 11.0.1 Advisory →
Red Hat 3 advisories
- RHSA-2026:93602 Released 2026-11-02 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs26-1:26.13.0-0.1.1.hum1@aarch64, nodejs26-1:26.13.0-0.1.1.hum1@s390x, nodejs26-1:26.13.0-0.1.1.hum1@src +25
- RHSA-2026:93603 Released 2026-11-02 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs22-1:22.23.4-2.3.2.3.1.hum1@aarch64, nodejs22-1:22.23.4-2.3.2.3.1.hum1@s390x, nodejs22-1:22.23.4-2.3.2.3.1.hum1@src +25
- RHSA-2026:93600 Released 2026-11-02 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs24-1:24.22.2-0.2.hum1@aarch64, nodejs24-1:24.22.2-0.2.hum1@s390x, nodejs24-1:24.22.2-0.2.hum1@src +25
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management On Premise | Affected | No fix yet: Fix deferred |
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Exploit Intelligence | Affected | No fix yet |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 11 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 12 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 13 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet |
| Red Hat Edge Manager 1 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Profile Analyzer | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Secrets Management Console for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Self-service automation portal 2 | Affected | No fix yet |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:93600, RHSA-2026:93602, RHSA-2026:93603 |
Not affected: 11 products
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Apache Camel - HawtIO 4
Timeline
- 2026-10-29 Threatist record created from CVE-2026-118764
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score added · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score changed · CNA
- 2026-10-30 Alias added: GHSA-g3hv-75wg-m249
- 2026-10-30 Fix available: npm/[email protected] · GHSA-g3hv-75wg-m249
- 2026-10-30 CVSS score added · GHSA-g3hv-75wg-m249
- 2026-10-30 Weakness changed · GHSA-g3hv-75wg-m249
- 2026-10-30 5 new references · GHSA-g3hv-75wg-m249
- 2026-10-31 Priority changed: MEDIUM → LOW
- 2026-11-03 Fix available: RHSA-2026:93602 · Red Hat
- 2026-11-03 Fix available: RHSA-2026:93600 · Red Hat
- 2026-11-03 Fix available: RHSA-2026:93603 · Red Hat
- 2026-11-03 Fix available: Red Hat Hardened Images · Red Hat
- 2026-11-03 Affected versions changed · CNA
- 2026-11-03 2 new references · CNA
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score changed · Red Hat
- 2026-11-04 Affected versions changed · GHSA-g3hv-75wg-m249
- 2026-11-04 2 new references · GHSA-g3hv-75wg-m249
References
Other 6
- https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
- https://github.com/isaacs/minimatch/commit/297b6c1a01f2410b3ba1ebed14ba222d0c3c1033
- https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
- https://github.com/isaacs/minimatch/commit/fd0b3ab9cbc5bf1aff1c99f1f46e413c2b3340da
- https://github.com/isaacs/minimatch/releases/tag/v11.0.1
- https://github.com/isaacs/minimatch
More isaacs vulnerabilities
- TI-2026-42687 node-tar: Decompression/parse DoS via unlimited input CVSS 4.0CRITICAL 9.2
- TI-2026-42688 node-tar: Negative tar entry size causes infinite loop in archive replace CVSS 4.0HIGH 8.7
- TI-2026-51656 Uncontrolled resource consumption in isaacs node-tar CVSS 3.1HIGH 7.5
- TI-2026-42686 node-tar: Process crash via PAX numeric path type confusion CVSS 3.1HIGH 7.5
- TI-2026-24357 node-tar Symlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
- TI-2026-23372 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
Sources
- CVE-2026-118764 · CVE Program
- CVE-2026-118764 · NVD
- FIRST EPSS
- GHSA-g3hv-75wg-m249 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-118764 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences