CVE-2026-118764mediumCWE-405

CVE-2026-118764: falha de média gravidade em isaacs minimatch

minimatch: potential denial of service via globparts amplification

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar minimatch+ Monitorar node-minimatch

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
isaacs · minimatch
CVEs relacionadas — isaacs minimatch

No mesmo produto, das mais perigosas para as menos.

CVE-2026-26996HIGHminimatch has a ReDoS via repeated wildcards with non-matching literal in patternEPSS 0.6%CVE-2026-27903HIGHminimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsEPSS 0.6%CVE-2026-27904HIGHminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsEPSS 0.5%