Cloudanix VulnDB

GHSA-23c5-xmqv-rm74

High · 7.5

CVSS

7.5

EPSS

—

Published

Feb 26, 2026

CISA due date

—

The record

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Affected packages

Ecosystem Package Introduced Fixed
npm minimatch 0 3.1.4
npm minimatch 10.0.0 10.2.3
npm minimatch 4.0.0 4.2.5
npm minimatch 5.0.0 5.1.8
npm minimatch 6.0.0 6.2.2
npm minimatch 7.0.0 7.4.8
npm minimatch 8.0.0 8.0.6
npm minimatch 9.0.0 9.0.7
Chainguard actions-runner 0 2.332.0-r1
Chainguard arangodb-3.11 0 3.11.14.3-r2
Chainguard arangodb-3.12 0 3.12.7.2-r3
Chainguard code-server 0 4.109.2-r0
Chainguard emscripten 0 5.0.2-r1
Chainguard eslint 0 10.0.2-r1
Chainguard graalvm-25-ce-nodejs 0 25.0.2-r4
Chainguard kibana-8.17 0 8.17.10-r12
Chainguard kibana-8.17-bitnami 0 8.17.10-r12
Chainguard kibana-8.17-iamguarded 0 8.17.10-r12
Chainguard kibana-8.19 0 8.19.12-r2
Chainguard kibana-8.19-bitnami 0 8.19.12-r2
Chainguard kibana-8.19-iamguarded 0 8.19.12-r2
Chainguard kibana-9.0 0 9.0.8-r13
Chainguard kibana-9.0-bitnami 0 9.0.8-r13
Chainguard kibana-9.0-iamguarded 0 9.0.8-r13
Chainguard kibana-9.1 0 9.1.10-r6
Chainguard kibana-9.1-iamguarded 0 9.1.10-r6
Chainguard kibana-9.2 0 9.2.5-r5
Chainguard kibana-9.2-iamguarded 0 9.2.5-r5
Chainguard kibana-9.3 0 9.3.0-r2
Chainguard kibana-9.3-iamguarded 0 9.3.0-r2
Chainguard kubeflow-centraldashboard 0 1.10.0-r13
Chainguard langfuse-2-worker 0 2.95.12-r12
Chainguard lerna 0 9.0.5-r1
Chainguard librechat 0 0.8.2-r6
Chainguard node-gyp 0 12.2.0-r2
Chainguard npm 0 11.11.0-r1
Chainguard opensearch-dashboards-2 0 2.19.4-r15
Chainguard opensearch-dashboards-2-dashboards-reporting 0 2.19.4-r15
Chainguard opensearch-dashboards-2-fips 0 2.19.4-r13
Chainguard opensearch-dashboards-2-fips-dashboards-reporting 0 2.19.4-r13
Chainguard opensearch-dashboards-3 0 3.5.0-r6
Chainguard opensearch-dashboards-3-dashboards-reporting 0 3.5.0-r6
Chainguard opentelemetry-auto-instrumentations-node 0 0.70.1-r1
Chainguard prism 0 5.14.3-r8
Chainguard pulumi-language-nodejs 0 3.224.0-r1
Chainguard renovate 0 43.49.0-r1
Chainguard serve 0 14.2.6-r0
Chainguard tileserver-gl 0 5.5.0-r6
Chainguard tileserver-gl-fips 0 5.5.0-r7
Chainguard vitess-22 0 22.0.4-r4
Chainguard vitess-23 0 23.0.3-r5
Wolfi code-server 0 4.109.2-r0
Wolfi eslint 0 10.0.2-r1
Wolfi kubeflow-centraldashboard 0 1.10.0-r13
Wolfi lerna 0 9.0.5-r1
Wolfi node-gyp 0 12.2.0-r2
Wolfi npm 0 11.11.0-r1
Wolfi opensearch-dashboards-2 0 2.19.4-r15
Wolfi opensearch-dashboards-2-dashboards-reporting 0 2.19.4-r15
Wolfi opensearch-dashboards-3 0 3.5.0-r6
Wolfi opensearch-dashboards-3-dashboards-reporting 0 3.5.0-r6
Wolfi prism 0 5.14.3-r8
Wolfi pulumi-language-nodejs 0 3.224.0-r1
Wolfi renovate 0 43.49.0-r1
Wolfi serve 0 14.2.6-r0
Wolfi tileserver-gl 0 5.5.0-r6
Wolfi vitess-22 0 22.0.4-r4
Wolfi vitess-23 0 23.0.3-r5

Related vulnerabilities