CVE-2026-118764 minimatch: potential denial of service via globparts amplification
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118764?
CVE-2026-118764 is a high-severity vulnerability in isaacs minimatch, published on 29 Oct 2026.
Official description
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
Weakness: CWE-405
Which versions are affected by CVE-2026-118764?
How do I fix CVE-2026-118764?
No fix has been published for CVE-2026-118764 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118764 being exploited?
There is no known exploitation of CVE-2026-118764 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-118764, GHSA-g3hv-75wg-m249.