CVE-2026-118764 in minimatch
Summary
by MITRE • 10/29/2026
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The minimatch library serves as a fundamental utility for converting glob expressions into JavaScript regular expression objects, enabling developers to perform complex file path matching operations within Node.js environments. A critical vulnerability exists in versions prior to 11.0.1, specifically rooted in the implementation of the firstPhasePreProcess function located in src/index.ts. This flaw manifests when the library operates at an optimization level of two or higher, a configuration often used to improve performance during pattern compilation. Under these conditions, the internal logic fails to properly bound the expansion of specific glob patterns that include attacker-controlled segments such as double asterisks followed by dot-dot notation, commonly represented as **/.. This structural oversight allows for uncontrolled recursion and repetition within a fixpoint loop designed to normalize path components.
The technical core of this vulnerability lies in the iterative processing mechanism used to expand these pattern segments. When an input glob contains sequences like **, the library attempts to resolve all possible matching paths by expanding wildcards into multiple potential file system entries. However, due to the lack of sufficient depth limits or cycle detection mechanisms for self-referential patterns involving parent directory traversal symbols, the expansion process enters a state of exponential growth. The fixpoint loop continues to generate new globParts entries indefinitely because each iteration produces variations that are not recognized as duplicates or terminal states by the subsequent processing phase. This results in an infinite or near-infinite loop where memory allocation and CPU cycles are consumed at an alarming rate, effectively starving other processes on the host system.
The operational impact of this flaw is severe, classifying it as a Denial of Service vulnerability that can be triggered remotely if minimatch is used to process user-supplied input without adequate sanitization or validation. An attacker can craft a short but malicious glob pattern that exploits this logic error to cause excessive CPU and memory consumption during the compilation phase. This does not require execution of arbitrary code, meaning it bypasses many traditional injection-based defenses, yet it effectively renders the application unresponsive by exhausting system resources. In web applications or API services where file path matching is performed on incoming requests, such a payload can lead to service outages and degraded performance for all users sharing the same infrastructure.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-675, Operation on Resources with Decreased or Limited Control, due to the failure to enforce limits on pattern expansion depth. In terms of attack vectors and tactics, it corresponds to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion through computational complexity. The vulnerability highlights the importance of validating input patterns against known malicious structures before passing them to parsing engines that perform complex recursive operations.
To mitigate this risk, organizations must immediately upgrade minimatch to version 11.0.1 or later, where the developers have addressed the logic error in firstPhasePreProcess by implementing proper bounds checking and cycle detection for glob expansion loops. For environments unable to update instantly, defensive coding practices should be adopted, including strict validation of input strings against a whitelist of allowed characters and patterns before they reach the minimatch parser. Additionally, applying resource limits such as CPU time quotas or memory caps at the process level can help contain the impact if an attack is attempted, ensuring that even successful exploitation does not compromise the stability of the broader system infrastructure.