Vulnerabilities

TI-2026-22248 CVE-2026-27904 · GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

HIGH 66

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00525 Published 2026-02-26 Partial fix · 10.2.3, 9.0.7 +6 CWE-1333

TI-2026-22247 CVE-2026-27903 · GHSA-7r86-cg39-jmmj

HIGH 66

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00576 Published 2026-02-26 Partial fix · 10.2.3, 9.0.7 +6 CWE-407

TI-2026-21474 CVE-2026-26996 · GHSA-3ppc-4f35-3m26

MEDIUM 44

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00577 Published 2026-02-20 Partial fix · 10.2.1, 9.0.6 +6 CWE-1333

TI-2022-03245 CVE-2022-3517 · GHSA-f8q6-p94x-37v3

MEDIUM 43

A vulnerability was found in the minimatch package.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02279 Published 2022-10-17 Partial fix · 3.0.5 CWE-400

TI-2016-08582 CVE-2016-10540 · GHSA-hxm2-r34f-qmc5

LOW 36

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01503 Published 2018-05-31 Fixed in 3.0.2 CWE-400