High USN-4783-1 1 CVE

node-minimatch vulnerability

Published Mar 15, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that minimatch did not perform necessary bounds checking
on regular expressions. An attacker could use this vulnerability to cause a
denial of service.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	node-minimatch	0.2.12-1ubuntu0.1~esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	node-minimatch	1.0.0-1ubuntu0.1~esm2

Vulnerabilities 1

High 7.5

CVE-2016-10540

Regular Expression Denial of Service in minimatch

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.

HackerOne minimatch node module js-jquery node-minimatch Debian Ubuntu Azure Linux npm

May 31, 2018

References

report
https://ubuntu.com/security/CVE-2016-10540