CVE-2026-118764

The record

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

Affected packages

Related vulnerabilities

• CVE-2026-119207 pypdf is a free and open-source pure-python PDF library. CWE-405
• CVE-2026-85783 Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of… CWE-405
• CVE-2026-110676 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding… CWE-405
• CVE-2026-109932 undici is an HTTP client library for Node.js. CWE-405
• CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a… CWE-405
• CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by… CWE-405
• CVE-2026-78659 When "Trailer" headers are sent by a client, the HTTP server internally uses the header… CWE-405
• CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should… CWE-405