Description
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| isaacs | minimatch | >= 7.0.0, < 11.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-minimatch | No fix yet | — |
| Debian 13 | node-minimatch | No fix yet | — |
| Debian 12 | node-minimatch | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-minimatch | No fix yet | — |
| Ubuntu 26.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu 24.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu 22.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu 20.04 LTS | node-minimatch | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu Pro 16.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu Pro 14.04 LTS | node-minimatch | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | nodejs +4 | 1:24.22.1-5.module+el9.8.0+25292+33251f3b | RHSA-2026:96226 |
| RHEL 9 | nodejs-nodemon | 3.1.14-6.module+el9.8.0+25292+33251f3b | RHSA-2026:96226 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24708+e71d2e1d | RHSA-2026:96226 |
| RHEL 9 | npm | 1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b | RHSA-2026:96226 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b | RHSA-2026:96226 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | nodejs22 +6 | 1:22.23.4-2.3.2.3.1.hum1 | RHSA-2026:93603 |
| Red Hat Hardened Images 1 | nodejs22-npm | 1:10.9.9-1.22.23.4.2.3.2.3.1.hum1 | RHSA-2026:93603 |
| Red Hat Hardened Images 1 | nodejs24 +5 | 1:24.22.2-0.2.hum1 | RHSA-2026:93600 |
| Red Hat Hardened Images 1 | nodejs24-npm | 2:11.19.1-1.24.22.2.0.2.hum1 | RHSA-2026:93600 |
| Red Hat Hardened Images 1 | nodejs24-npm-bin | 2:24.22.2-0.2.hum1 | RHSA-2026:93600 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 1:26.13.0-0.1.1.hum1 | RHSA-2026:93602 |
| Red Hat Hardened Images 1 | nodejs26-npm | 1:11.20.0-1.26.13.0.0.1.1.hum1 | RHSA-2026:93602 |
| Red Hat Hardened Images 1 | v8-12.4-devel | 3:12.4.254.21-1.22.23.4.2.3.2.3.1.hum1 | RHSA-2026:93603 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 3:13.6.233.17-1.24.22.2.0.2.hum1 | RHSA-2026:93600 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 3:14.6.202.34-1.26.13.0.0.1.1.hum1 | RHSA-2026:93602 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:96226 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | nodejs +4 | 1:24.21.0-1.0.1.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-6.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-96226 |
| Oracle Linux 9 | npm | 1:11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.15-r5 | — |
| Wolfi rolling | eslint | 10.15.0-r0 | — |
| Wolfi rolling | langfuse-3-worker | 3.227.0-r1 | — |
| Wolfi rolling | lerna | 10.1.1-r4 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.10-r7 | — |
| Wolfi rolling | npm-12 | 12.2.2-r1 | — |
| Wolfi rolling | opensearch-dashboards-3 +12 | 3.9.0-r7 | — |
| Wolfi rolling | prism | 5.16.0-r23 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.273.0-r2 | — |
| Wolfi rolling | rancher-api-ui | 1.2.3-r15 | — |
| Wolfi rolling | renovate | 44.198.3-r1 | — |
| Wolfi rolling | saf | 1.7.0-r6 | — |
| Wolfi rolling | serve | 14.2.6-r9 | — |
| Wolfi rolling | thingsboard-tb-web-ui +1 | 4.4.0.2-r1 | — |
| Wolfi rolling | tileserver-gl | 5.7.0-r2 | — |
| Wolfi rolling | ts-patch | 4.0.1-r50 | — |
| Wolfi rolling | vitess-23 | 23.0.8-r4 | — |
| Wolfi rolling | vitess-24 | 24.0.5-r10 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
b1nv0id/CVE-2026-118764 ★ 0 · Nov 1, 2026
CVE-2026-118764 dos in minimatch
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | minimatch | >= 7.0.0, < 11.0.1 | 11.0.1 | GHSA-g3hv-75wg-m249 |
Advisories 6
- RHSA-2026:96226 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93600 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93602 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93603 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:96226 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 10, 2026
- ELSA-2026-96226 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
References
- https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
- https://github.com/isaacs/minimatch/commit/297b6c1a01f2410b3ba1ebed14ba222d0c3c1033
- https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
- https://github.com/isaacs/minimatch/commit/fd0b3ab9cbc5bf1aff1c99f1f46e413c2b3340da
- https://github.com/isaacs/minimatch/releases/tag/v11.0.1