Description
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| isaacs | minimatch | >= 10.0.0, < 10.2.3, >= 9.0.0, < 9.0.7, >= 8.0.0, < 8.0.6, >= 7.0.0, < 7.4.8, >= 6.0.0, < 6.2.2, >= 5.0.0, < 5.1.8, >= 4.0.0, < 4.2.5, < 3.1.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-minimatch | 9.0.7-1 | — |
| Debian 13 | node-minimatch | No fix yet | — |
| Debian 12 | node-minimatch | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-minimatch | No fix yet | — |
| Ubuntu 26.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu 25.10 | node-minimatch | No fix yet | — |
| Ubuntu 24.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu 22.04 LTS | node-minimatch | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu 18.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu Pro 16.04 LTS | node-minimatch | No fix yet | — |
| Ubuntu Pro 14.04 LTS | node-minimatch | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs +5 | 1:22.22.2-1.el10_1 | RHSA-2026:7080 |
| RHEL 10 | nodejs-npm | 1:10.9.7-1.22.22.2.1.el10_1 | RHSA-2026:7080 |
| RHEL 9 | nodejs +3 | 1:20.20.2-1.module+el9.7.0+24193+41b7b572 | RHSA-2026:7896, RHSA-2026:7302 |
| RHEL 9 | nodejs-libs | 1:22.22.2-1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7302 |
| RHEL 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7896, RHSA-2026:7302 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7896, RHSA-2026:7302 |
| RHEL 9 | npm | 1:10.8.2-1.20.20.2.1.module+el9.7.0+24193+41b7b572 | RHSA-2026:7896, RHSA-2026:7302 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461 | RHSA-2026:7302 |
| RHEL 8 | nodejs +3 | 1:20.20.2-1.module+el8.10.0+24197+1602b452 | RHSA-2026:8339, RHSA-2026:7123 |
| RHEL 8 | nodejs-libs | 1:22.22.2-1.module+el8.10.0+24148+847b6786 | RHSA-2026:7123 |
| RHEL 8 | nodejs-nodemon | 3.0.1-1.module+el8.10.0+23521+490ebfde | RHSA-2026:8339, RHSA-2026:7123 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24148+847b6786 | RHSA-2026:8339, RHSA-2026:7123 |
| RHEL 8 | npm | 1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452 | RHSA-2026:8339, RHSA-2026:7123 |
| RHEL 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786 | RHSA-2026:7123 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | nodejs +5 | 1:22.22.2-2.el10_0 | RHSA-2026:7310 |
| RHEL 10.0 EUS | nodejs-npm | 1:10.9.7-1.22.22.2.2.el10_0 | RHSA-2026:7310 |
| RHEL 9.6 EUS | nodejs +3 | 1:20.20.2-2.module+el9.6.0+24220+c44c288d | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-libs | 1:22.22.2-1.module+el9.6.0+24196+39669d4e | RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-nodemon | 3.0.1-1.module+el9.6.0+23146+be9976bd | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.6.0+23146+be9976bd | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | npm | 1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d | RHSA-2026:9874, RHSA-2026:7983 |
| RHEL 9.6 EUS | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e | RHSA-2026:7983 |
| RHEL 9.4 EUS | nodejs +3 | 1:20.20.2-2.module+el9.4.0+24216+64c58546 | RHSA-2026:9711 |
| RHEL 9.4 EUS | nodejs-nodemon | 3.0.1-1.module+el9.3.0.z+20478+84a9f781 | RHSA-2026:9711 |
| RHEL 9.4 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.3.0+19518+63aad52d | RHSA-2026:9711 |
| RHEL 9.4 EUS | npm | 1:10.8.2-1.20.20.2.2.module+el9.4.0+24216+64c58546 | RHSA-2026:9711 |
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.40.0-6.redhat_00012.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus +1 | 2.0.5-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus-activation | 2.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.84.0-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.6.0-1.GA_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava +1 | 33.0.0-3.jre_redhat_00004.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava-failureaccess | 1.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.7.19-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.6.48-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate-search +6 | 7.2.6-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jakarta-activation | 2.1.4-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-logging | 3.6.2-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-metadata +5 | 16.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jctools +1 | 4.0.6-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.132-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-plexus-utils | 3.6.1-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava | 3.1.12-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava2 | 2.2.21-5.redhat_00003.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.6-5.GA_redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-client-config | 1.0.1-4.Final_redhat_00002.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-http-client +4 | 2.1.4-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-10.GA_redhat_00017.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl +1 | 2.3.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el8-x86_64 | 2.3.0-1.Final.redhat.00001.1.el8eap | RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el9-x86_64 | 2.3.0-1.Final_redhat_00001.1.el9eap | RHSA-2026:18055 |
| Red Hat JBoss EAP 8 | eap8-yasson | 3.0.4-5.redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.29-2.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | 2.6.14-1.el9 | RHSA-2026:6277 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.5.10-6.el8ap | RHSA-2026:24761, RHSA-2026:6277 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260422-3.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.7-1.el9ap | RHSA-2026:6277 |
| Red Hat Ansible Automation Platform 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-pillow | 12.1.1-1.el9ap | RHSA-2026:24761, RHSA-2026:6277 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24761 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs-docs | 1:22.22.2-1.el10_1 | ALSA-2026:7080 |
| AlmaLinux 9 | nodejs | 1:20.20.2-1.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux 9 | nodejs-docs +2 | 1:20.20.2-1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.5.0+125+8dc38870 | ALSA-2026:7896 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux 9 | npm | 1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux 8 | nodejs +3 | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339, ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-libs | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3982+85c136aa | ALSA-2026:8339, ALSA-2026:7123 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:8339, ALSA-2026:7123 |
| AlmaLinux 8 | npm | 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339, ALSA-2026:7123 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs22 | 1:22.22.2-1.el10_1 | RLSA-2026:7080 |
| Rocky Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:7896, RLSA-2026:7302 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:7896, RLSA-2026:7302 |
| Rocky Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:8339, RLSA-2026:7123 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:8339, RLSA-2026:7123 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | cockpit | 364-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-machines | 354-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-packages | 5-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-podman | 128-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-repos | 4.8-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-subscriptions | 16.2-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit | 364-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-machines | 354-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-packages | 5-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-podman | 128-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-repos | 4.8-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-subscriptions | 16.2-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLE Micro 6.2 | cockpit | 364-160000.1.1 | SUSE-SU-2026:22770-1 |
| SLE Micro 6.2 | cockpit-machines | 354-160000.1.1 | SUSE-SU-2026:22770-1 |
| SLE Micro 6.2 | cockpit-podman | 128-160000.1.1 | SUSE-SU-2026:22770-1 |
| SLE Micro 6.2 | cockpit-repos | 4.8-160000.1.1 | SUSE-SU-2026:22770-1 |
| SLE Micro 6.2 | cockpit-subscriptions | 16.2-160000.1.1 | SUSE-SU-2026:22770-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | cockpit | 298-150500.3.12.1 | SUSE-SU-2026:2363-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cockpit-repos | 4.9-1.1 | openSUSE-SU-2026:11446-1 |
| openSUSE Tumbleweed | cockpit-subscriptions | 16.3-1.1 | openSUSE-SU-2026:11447-1 |
| openSUSE Tumbleweed | onnxruntime | 1.26.0-1.1 | openSUSE-SU-2026:11146-1 |
| openSUSE Tumbleweed | openQA | 5.1782995932.ffeb09be-1.1 | openSUSE-SU-2026:11178-1 |
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git185.a5708584-2.1 | openSUSE-SU-2026:11126-1 |
| openSUSE Leap 16.0 | cockpit | 364-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-machines | 354-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-packages | 5-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-podman | 128-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-repos | 4.8-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-subscriptions | 16.2-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | openQA | 5.1783076943.6691832d-bp160.1.1 | openSUSE-SU-2026:21266-1 |
| openSUSE Leap 16.0 | os-autoinst | 5.1783082953.c3cb41d-bp160.1.1 | openSUSE-SU-2026:21266-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.22.2-1.el10_1 | ELSA-2026-7080 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.7-1.22.22.2.1.el10_1 | ELSA-2026-7080 |
| Oracle Linux 9 | nodejs +3 | 1:20.20.2-1.module+el9.7.0+90874+6d84790f | ELSA-2026-7896, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-libs | 1:22.22.2-1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7896, ELSA-2026-7302 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.7.0+90867+2ede48fe | ELSA-2026-7896, ELSA-2026-7302 |
| Oracle Linux 9 | npm | 1:10.8.2-1.20.20.2.1.module+el9.7.0+90874+6d84790f | ELSA-2026-7896, ELSA-2026-7302 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el9.7.0+90867+2ede48fe | ELSA-2026-7302 |
| Oracle Linux 8 | nodejs +3 | 1:20.20.2-1.module+el8.10.0+90878+0d41f8c0 | ELSA-2026-8339, ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-libs | 1:22.22.2-1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.10.0+90743+b61054a8 | ELSA-2026-8339, ELSA-2026-7123 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.10.0+90865+d647ef3a | ELSA-2026-8339, ELSA-2026-7123 |
| Oracle Linux 8 | npm | 1:10.8.2-1.20.20.2.1.module+el8.10.0+90878+0d41f8c0 | ELSA-2026-8339, ELSA-2026-7123 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module+el8.10.0+90865+d647ef3a | ELSA-2026-7123 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.4-r6 | — |
| Wolfi rolling | code-server | 4.109.2-r0 | — |
| Wolfi rolling | eslint | 10.0.2-r1 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r23 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r13 | — |
| Wolfi rolling | lerna | 9.0.5-r1 | — |
| Wolfi rolling | node-gyp | 12.2.0-r2 | — |
| Wolfi rolling | npm | 11.11.0-r1 | — |
| Wolfi rolling | opensearch-dashboards-3 +1 | 3.5.0-r5 | — |
| Wolfi rolling | pnpm-stage0 | 8.7.4-r5 | — |
| Wolfi rolling | prism | 5.14.3-r8 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.224.0-r1 | — |
| Wolfi rolling | py3.10-jupyterlab +3 | 4.6.1-r1 | — |
| Wolfi rolling | renovate | 43.48.3-r0 | — |
| Wolfi rolling | saf | 1.6.0-r0 | — |
| Wolfi rolling | serve | 14.2.6-r0 | — |
| Wolfi rolling | tileserver-gl | 5.5.0-r6 | — |
| Wolfi rolling | ts-patch | 4.0.1-r0 | — |
| Wolfi rolling | vitess-23 | 23.0.3-r5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | minimatch | >= 10.0.0, < 10.2.3 | 10.2.3 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | >= 9.0.0, < 9.0.7 | 9.0.7 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | >= 8.0.0, < 8.0.6 | 8.0.6 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | >= 7.0.0, < 7.4.8 | 7.4.8 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | >= 6.0.0, < 6.2.2 | 6.2.2 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | >= 5.0.0, < 5.1.8 | 5.1.8 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | >= 4.0.0, < 4.2.5 | 4.2.5 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | < 3.1.4 | 3.1.4 | GHSA-23c5-xmqv-rm74 |
Advisories 42
- RHSA-2026:6277 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:7896 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7080 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7123 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:8339 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:9711 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9874 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:8339 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7983 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7896 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7302 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7310 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7123 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7080 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:24761 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:18055 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:18054 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- openSUSE-SU-2026:11446-1 cockpit-repos-4.9-1.1 on GA media SUSE / openSUSE Security Updates · Aug 5, 2026
- openSUSE-SU-2026:11447-1 cockpit-subscriptions-16.3-1.1 on GA media SUSE / openSUSE Security Updates · Aug 5, 2026
- SUSE-SU-2026:22837-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 28, 2026
- openSUSE-SU-2026:21399-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:22770-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 23, 2026
- WID-SEC-2026-2394 HCL BigFix (Service Management): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 16, 2026
- openSUSE-SU-2026:21266-1 Security update for openQA, os-autoinst SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:11178-1 openQA-5.1782995932.ffeb09be-1.1 on GA media SUSE / openSUSE Security Updates · Jul 3, 2026
- openSUSE-SU-2026:11146-1 libonnxruntime1-1.26.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:11126-1 velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
- SUSE-SU-2026:2363-1 Security update for cockpit SUSE / openSUSE Security Updates · Jun 12, 2026
- WID-SEC-2026-1220 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
- WID-SEC-2026-0752 IBM SPSS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
- ELSA-2026-8339 Important: nodejs:20 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 17, 2026
- RLSA-2026:8339 Important: nodejs:20 security update Rocky Linux Security Advisories · Apr 16, 2026
- RLSA-2026:7896 Important: nodejs:20 security update Rocky Linux Security Advisories · Apr 14, 2026
- ELSA-2026-7896 Important: nodejs:20 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 14, 2026
- RLSA-2026:7080 Important: nodejs22 security update Rocky Linux Security Advisories · Apr 12, 2026
- ELSA-2026-7302 Important: nodejs:22 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 10, 2026
- RLSA-2026:7302 Important: nodejs:22 security update Rocky Linux Security Advisories · Apr 9, 2026
- RLSA-2026:7123 Important: nodejs:22 security update Rocky Linux Security Advisories · Apr 9, 2026
- ELSA-2026-7123 Important: nodejs:22 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 9, 2026
- ELSA-2026-7080 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Apr 8, 2026