Source: node-minimatch Version: 9.0.7-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for node-minimatch. CVE-2026-118764[0]: | minimatch is a minimal matching utility for converting glob | expressions into JavaScript RegExp objects. Prior to 11.0.1, | src/index.ts implements firstPhasePreProcess() so that, at | optimizationLevel 2 or higher, it repeatedly expands attacker- | controlled **/.. pattern segments inside a fixpoint loop, allowing | generated globParts entries to be processed and expanded again. | secondPhasePreProcess() then compares the expanded entries pairwise, | so a short malicious glob can cause excessive CPU and memory | consumption during pattern compilation. This issue is fixed in | version 11.0.1. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-118764 https://www.cve.org/CVERecord?id=CVE-2026-118764 [1] https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249 [2] https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
