Description
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| isaacs | minimatch | < 10.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-minimatch | 9.0.7-1 | — |
| Debian 13 | node-minimatch | No fix yet | — |
| Debian 12 | node-minimatch | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-minimatch | No fix yet | — |
| Ubuntu 26.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu 25.10 | node-minimatch | No fix yet | — |
| Ubuntu 24.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu 22.04 LTS | node-minimatch | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu 18.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu Pro 16.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu Pro 14.04 LTS | node-minimatch | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs +5 | 1:22.22.2-1.el10_1 | RHSA-2026:7080 |
| RHEL 10 | nodejs-npm | 1:10.9.7-1.22.22.2.1.el10_1 | RHSA-2026:7080 |
| RHEL 10 | nodejs24 +4 | 1:24.14.1-2.el10_1 | RHSA-2026:7675 |
| RHEL 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.el10_1 | RHSA-2026:7675 |
| RHEL 9 | nodejs +3 | 1:20.20.2-1.module+el9.7.0+24193+41b7b572 | RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | nodejs-libs | 1:22.22.2-1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | npm | 1:10.8.2-1.20.20.2.1.module+el9.7.0+24193+41b7b572 | RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7302 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b | RHSA-2026:7350 |
| RHEL 8 | nodejs +3 | 1:20.20.2-1.module+el8.10.0+24197+1602b452 | RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | nodejs-libs | 1:22.22.2-1.module+el8.10.0+24148+847b6786 | RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | nodejs-nodemon | 3.0.1-1.module+el8.10.0+23521+490ebfde | RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24148+847b6786 | RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | npm | 1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452 | RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123 |
| RHEL 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786 | RHSA-2026:7123 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75 | RHSA-2026:7670 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | nodejs +5 | 1:22.22.2-2.el10_0 | RHSA-2026:7310 |
| RHEL 10.0 EUS | nodejs-npm | 1:10.9.7-1.22.22.2.2.el10_0 | RHSA-2026:7310 |
| RHEL 9.6 EUS | nodejs +3 | 1:20.20.2-2.module+el9.6.0+24220+c44c288d | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-libs | 1:22.22.2-1.module+el9.6.0+24196+39669d4e | RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-nodemon | 3.0.1-1.module+el9.6.0+23146+be9976bd | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.6.0+23146+be9976bd | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | npm | 1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e | RHSA-2026:7983 |
| RHEL 9.4 EUS | nodejs +3 | 1:20.20.2-2.module+el9.4.0+24216+64c58546 | RHSA-2026:9711 |
| RHEL 9.4 EUS | nodejs-nodemon | 3.0.1-1.module+el9.3.0.z+20478+84a9f781 | RHSA-2026:9711 |
| RHEL 9.4 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.3.0+19518+63aad52d | RHSA-2026:9711 |
| RHEL 9.4 EUS | npm | 1:10.8.2-1.20.20.2.2.module+el9.4.0+24216+64c58546 | RHSA-2026:9711 |
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.40.0-6.redhat_00012.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus +1 | 2.0.5-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus-activation | 2.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.84.0-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.6.0-1.GA_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava +1 | 33.0.0-3.jre_redhat_00004.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava-failureaccess | 1.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.7.19-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.6.48-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate-search +6 | 7.2.6-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jakarta-activation | 2.1.4-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-logging | 3.6.2-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-metadata +5 | 16.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jctools +1 | 4.0.6-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.132-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-plexus-utils | 3.6.1-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava | 3.1.12-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava2 | 2.2.21-5.redhat_00003.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.6-5.GA_redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-client-config | 1.0.1-4.Final_redhat_00002.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-http-client +4 | 2.1.4-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-10.GA_redhat_00017.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl +1 | 2.3.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el8-x86_64 | 2.3.0-1.Final.redhat.00001.1.el8eap | RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el9-x86_64 | 2.3.0-1.Final_redhat_00001.1.el9eap | RHSA-2026:18055 |
| Red Hat JBoss EAP 8 | eap8-yasson | 3.0.4-5.redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.6.4-2.el9ap | RHSA-2026:24761, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.11-2.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.6.4-2.el9ap | RHSA-2026:24761, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-controller +3 | 4.7.11-2.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.29-2.el8ap | RHSA-2026:24761, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.5.10-6.el8ap | RHSA-2026:24761, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260422-3.el8ap | RHSA-2026:24761, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.8-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-django-ansible-base +11 | 2.6.20260422-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-jwcrypto | 1.5.7-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-markdown | 3.10.2-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-pillow | 12.2.0-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyOpenSSL | 26.0.0-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyasn1 | 0.6.3-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.12.1-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.6.4-2.el9ap | RHSA-2026:24761, RHSA-2026:13508 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs-docs | 1:22.22.2-1.el10_1 | ALSA-2026:7080 |
| AlmaLinux 10 | nodejs24-docs | 1:24.14.1-2.el10_1 | ALSA-2026:7675 |
| AlmaLinux 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.el10_1 | ALSA-2026:7675 |
| AlmaLinux 9 | nodejs | 1:20.20.2-1.module_el9.7.0+226+88d36870 | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-docs +2 | 1:20.20.2-1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-libs | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.5.0+125+8dc38870 | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+198+8bf605ba | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | npm | 1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896, ALSA-2026:7350 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux 8 | nodejs +3 | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-libs | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3982+85c136aa | ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | npm | 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42 | ALSA-2026:7670 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs22 | 1:22.22.2-1.el10_1 | RLSA-2026:7080 |
| Rocky Linux 10 | nodejs24 | 1:24.14.1-2.el10_1 | RLSA-2026:7675 |
| Rocky Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:7896, RLSA-2026:7350, RLSA-2026:7302 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:7896, RLSA-2026:7350, RLSA-2026:7302 |
| Rocky Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:8339, RLSA-2026:7670, RLSA-2026:7123 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:8339, RLSA-2026:7670, RLSA-2026:7123 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | cockpit | 354-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21166-1 |
| SLES for SAP 16.0 | cockpit-machines | 346-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21168-1 |
| SLES for SAP 16.0 | cockpit-packages | 4-160000.1.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21141-1 |
| SLES for SAP 16.0 | cockpit-podman | 117-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21167-1 |
| SLES for SAP 16.0 | cockpit-repos | 4.7-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:20997-1 |
| SLES for SAP 16.0 | cockpit-subscriptions | 12.1-160000.3.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21191-1 |
| SLES 16.0 | cockpit | 354-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21166-1 |
| SLES 16.0 | cockpit-machines | 346-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21168-1 |
| SLES 16.0 | cockpit-packages | 4-160000.1.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21141-1 |
| SLES 16.0 | cockpit-podman | 117-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21167-1 |
| SLES 16.0 | cockpit-repos | 4.7-160000.2.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:20997-1 |
| SLES 16.0 | cockpit-subscriptions | 12.1-160000.3.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21191-1 |
| SLE Micro 6.2 | cockpit | 354-160000.2.1 | SUSE-SU-2026:22770-1, SUSE-SU-2026:21022-1 |
| SLE Micro 6.2 | cockpit-machines | 346-160000.2.1 | SUSE-SU-2026:22770-1, SUSE-SU-2026:21024-1 |
| SLE Micro 6.2 | cockpit-podman | 117-160000.2.1 | SUSE-SU-2026:22770-1, SUSE-SU-2026:21023-1 |
| SLE Micro 6.2 | cockpit-repos | 4.7-160000.2.1 | SUSE-SU-2026:22770-1, SUSE-SU-2026:20973-1, SUSE-SU-2026:20967-1 |
| SLE Micro 6.2 | cockpit-subscriptions | 12.1-160000.3.1 | SUSE-SU-2026:22770-1, SUSE-SU-2026:21111-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | cockpit | 322-slfo.1.1_3.1 | SUSE-SU-2026:21241-1 |
| SLE Micro 6.1 | cockpit-machines | 316-slfo.1.1_3.1 | SUSE-SU-2026:21253-1 |
| SLE Micro 6.1 | cockpit-podman | 91-slfo.1.1_4.1 | SUSE-SU-2026:21256-1 |
| SLE Micro 6.0 | cockpit-machines | 305-4.1 | SUSE-SU-2026:21246-1 |
| SLE Micro 6.0 | cockpit-tukit | 0.1.2~git0.647b3e3-2.1 | SUSE-SU-2026:21245-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-41.1 | SUSE-SU-2026:21241-1 |
| SLE Micro 5.2 | cockpit | 251.3-150300.6.9.1 | SUSE-SU-2026:1232-1 |
| SLE Micro 5.2 | cockpit-machines | 249.1-150300.5.6.1 | SUSE-SU-2026:1249-1 |
| SLE Micro 5.2 | cockpit-podman | 33-150300.6.9.1 | SUSE-SU-2026:1251-1 |
| SLE Micro 5.2 | cockpit-tukit | 0.0.3~git14.ff11a9a-150300.1.9.1 | SUSE-SU-2026:1250-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openQA | 5.1782995932.ffeb09be-1.1 | openSUSE-SU-2026:11178-1 |
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git185.a5708584-2.1 | openSUSE-SU-2026:11126-1 |
| openSUSE Leap 16.0 | cockpit | 354-160000.2.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20504-1 |
| openSUSE Leap 16.0 | cockpit-machines | 346-160000.2.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20503-1 |
| openSUSE Leap 16.0 | cockpit-packages | 4-160000.1.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20469-1 |
| openSUSE Leap 16.0 | cockpit-podman | 117-160000.2.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20502-1 |
| openSUSE Leap 16.0 | cockpit-repos | 4.7-160000.2.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20464-1 |
| openSUSE Leap 16.0 | cockpit-subscriptions | 12.1-160000.3.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20532-1 |
| openSUSE Leap 16.0 | openQA | 5.1783076943.6691832d-bp160.1.1 | openSUSE-SU-2026:21266-1 |
| openSUSE Leap 16.0 | os-autoinst | 5.1783082953.c3cb41d-bp160.1.1 | openSUSE-SU-2026:21266-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.22.2-1.el10_1 | ELSA-2026-7080 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.7-1.22.22.2.1.el10_1 | ELSA-2026-7080 |
| Oracle Linux 10 | nodejs24 +4 | 1:24.14.1-2.0.2.el10_1 | ELSA-2026-7675 |
| Oracle Linux 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.0.2.el10_1 | ELSA-2026-7675 |
| Oracle Linux 9 | nodejs +3 | 1:20.20.2-1.module+el9.7.0+90874+6d84790f | ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-libs | 1:22.22.2-1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.7.0+90866+5a953a4c | ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | npm | 1:10.8.2-1.20.20.2.1.module+el9.7.0+90874+6d84790f | ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7302 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+90866+5a953a4c | ELSA-2026-7350 |
| Oracle Linux 8 | nodejs +3 | 1:20.20.2-1.module+el8.10.0+90878+0d41f8c0 | ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-libs | 1:22.22.2-1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.10.0+90743+b61054a8 | ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.10.0+90865+d647ef3a | ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | npm | 1:10.8.2-1.20.20.2.1.module+el8.10.0+90878+0d41f8c0 | ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7123 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+90873+35652ecc | ELSA-2026-7670 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.1-r2 | — |
| Wolfi rolling | code-server | 4.106.3-r5 | — |
| Wolfi rolling | eslint | 10.0.1-r0 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r23 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r12 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.16.0-r0 | — |
| Wolfi rolling | langfuse-3 +1 | 3.155.1-r2 | — |
| Wolfi rolling | lerna | 9.0.4-r3 | — |
| Wolfi rolling | node-gyp | 12.2.0-r2 | — |
| Wolfi rolling | npm | 11.10.1-r0 | — |
| Wolfi rolling | opensearch-dashboards-3 +1 | 3.5.0-r5 | — |
| Wolfi rolling | pnpm-stage0 | 8.7.4-r5 | — |
| Wolfi rolling | prism | 5.14.3-r8 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.223.0-r1 | — |
| Wolfi rolling | py3.10-jupyterlab +3 | 4.6.1-r1 | — |
| Wolfi rolling | rancher-api-ui | 1.2.3-r5 | — |
| Wolfi rolling | renovate | 43.38.0-r1 | — |
| Wolfi rolling | saf | 1.6.0-r0 | — |
| Wolfi rolling | serve | 14.2.6-r0 | — |
| Wolfi rolling | sqlpad | 7.5.7-r10 | — |
| Wolfi rolling | tileserver-gl | 5.5.0-r5 | — |
| Wolfi rolling | ts-patch | 4.0.1-r0 | — |
| Wolfi rolling | vitess-23 | 23.0.2-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | minimatch | >= 10.0.0, < 10.2.1 | 10.2.1 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | >= 9.0.0, < 9.0.6 | 9.0.6 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | >= 8.0.0, < 8.0.5 | 8.0.5 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | >= 7.0.0, < 7.4.7 | 7.4.7 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | >= 6.0.0, < 6.2.1 | 6.2.1 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | >= 5.0.0, < 5.1.7 | 5.1.7 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | >= 4.0.0, < 4.2.4 | 4.2.4 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | < 3.1.3 | 3.1.3 | GHSA-3ppc-4f35-3m26 |
Advisories 50
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2933 Splunk SOAR: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:7896 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7350 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7675 Important: nodejs24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7080 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7670 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7123 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:8339 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:9711 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9874 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:8339 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7983 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7896 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7675 Red Hat Security Advisory: nodejs24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7670 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7350 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7302 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7310 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7123 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7080 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:24761 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:18055 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:18054 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:13508 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- SUSE-SU-2026:22837-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 28, 2026
- openSUSE-SU-2026:21399-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:22770-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 23, 2026
- openSUSE-SU-2026:21266-1 Security update for openQA, os-autoinst SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:11178-1 openQA-5.1782995932.ffeb09be-1.1 on GA media SUSE / openSUSE Security Updates · Jul 3, 2026
- openSUSE-SU-2026:11126-1 velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
- ELSA-2026-7675 Important: nodejs24 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 9, 2026
- WID-SEC-2026-0752 IBM SPSS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
- SUSE-SU-2026:21246-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:21245-1 Security update for cockpit-tukit SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:21253-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:21241-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:21256-1 Security update for cockpit-podman SUSE / openSUSE Security Updates · Apr 24, 2026
- openSUSE-SU-2026:20504-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 22, 2026
- openSUSE-SU-2026:20502-1 Security update for cockpit-podman SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21191-1 Security update for cockpit-subscriptions SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21168-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21167-1 Security update for cockpit-podman SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21166-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 22, 2026
- openSUSE-SU-2026:20503-1 Security update for cockpit-machines SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21141-1 Security update for cockpit-packages SUSE / openSUSE Security Updates · Apr 22, 2026
- openSUSE-SU-2026:20532-1 Security update for cockpit-subscriptions SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21111-1 Security update for cockpit-subscriptions SUSE / openSUSE Security Updates · Apr 17, 2026
- ELSA-2026-8339 Important: nodejs:20 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 17, 2026