Skip to content
Fencer Vulns
high 7.5

CVE-2022-3517 json

minimatch ReDoS vulnerability

published 2022-10-17 4 y ago modified 2026-09-10 1 mo ago also GHSA-f8q6-p94x-37v3 , EUVD-2022-7089

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Patch / fix

  • npm minimatch 3.0.5
  • minimatch_project minimatch 3.0.5
  • node-minimatch Debian 14, Debian 13, Debian 12 3.0.5+~3.0.5-1

debian advisories DEBIAN-CVE-2022-3517

  • node-minimatch Ubuntu 18.04 LTS 3.0.4-3+deb10u1build0.18.04.1
  • node-minimatch Ubuntu 20.04 LTS 3.0.4-4ubuntu0.1

ubuntu advisories UBUNTU-CVE-2022-3517

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • npm RHEL 8 1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6
  • nodejs RHEL 8 1:14.21.3-1.module+el8.7.0+18531+81d21ca6
  • nodejs-nodemon RHEL 8 2.0.20-3.module+el8.7.0+18531+81d21ca6
  • nodejs-full-i18n RHEL 8 1:14.21.3-1.module+el8.7.0+18531+81d21ca6
  • nodejs-packaging RHEL 8, RHEL 8.6 EUS, RHEL 8.4 EUS 23-3.module+el8.3.0+6519+9f98ed83
  • npm RHEL 8 1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47
  • nodejs RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47
  • nodejs-nodemon RHEL 8 2.0.20-2.module+el8.7.0+17528+a329cd47

red hat advisories RHSA-2023:1743RHSA-2023:1742RHSA-2023:1533RHSA-2023:0050RHSA-2022:9073RHSA-2022:8832

  • npm AlmaLinux 8 1:6.14.18-1.14.21.3.1.module_el8.7.0+3551+53700ee8
  • nodejs AlmaLinux 8 1:14.21.3-1.module_el8.7.0+3551+53700ee8
  • nodejs-nodemon AlmaLinux 8 2.0.20-3.module_el8.7.0+3551+53700ee8
  • nodejs-full-i18n AlmaLinux 8 1:14.21.3-1.module_el8.7.0+3551+53700ee8
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.4.0+2522+3bd42762
  • nodejs AlmaLinux 9 1:16.18.1-3.el9_1
  • nodejs-nodemon AlmaLinux 9 2.0.20-2.el9_1
  • npm AlmaLinux 9 1:8.19.2-1.16.18.1.3.el9_1

almalinux advisories ALSA-2023:1743ALSA-2023:0321ALSA-2023:0050ALSA-2022:9073ALSA-2022:8832ALSA-2022:8833

  • nodejs Rocky Linux 8 1:14.21.3-1.module+el8.7.0+1183+c2c35f0a
  • nodejs-nodemon Rocky Linux 8 2.0.20-3.module+el8.7.0+1178+d52dba78
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
  • nodejs Rocky Linux 9 1:16.18.1-3.el9_1
  • nodejs-nodemon Rocky Linux 9 2.0.20-2.el9_1
  • nodejs Rocky Linux 8 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4
  • nodejs-nodemon Rocky Linux 8 2.0.20-2.module+el8.7.0+1108+49363b0d
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7

rocky linux advisories RLSA-2023:1743RLSA-2023:0321RLSA-2023:0050RLSA-2022:9073RLSA-2022:8833RLSA-2022:8832

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-3517 updated cvss 7.5

nodejs-minimatch: ReDoS via the braceExpand function

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Developer Tools and Services odo Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus, openshift-service-mesh/kiali-rhel8
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, openshift-service-mesh/kiali-rhel8 Red Hat 3scale API Management Platform 2 3scale-amp-system
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, rhacm2/console-rhel8, rhacm2/search-ui-rhel8, rhacm2/grc-ui-api-rhel8, rhacm2/search-api-rhel8, rhacm2/application-ui-rhel8
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator Red Hat Ansible Automation Platform 2 aap-azure-ui Red Hat build of Apicurio Registry 2 nodejs-minimatch
    affected: no fix available
  • Red Hat Ceph Storage 4 cockpit-ceph-installer
    affected: no fix planned “Will not fix”
  • Red Hat Decision Manager 7 nodejs-minimatch
    affected: no fix planned “Out of support scope”
show 20 more
  • Red Hat Directory Server 11 389-ds-base Red Hat Directory Server 12 389-ds-base
    affected: no fix planned “Will not fix”
  • Red Hat Discovery 1 discovery-server-container
    affected: no fix available
  • Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, 389-ds-base, grafana-loki, grafana-mssql, +16 more Red Hat Enterprise Linux 9 gjs, grafana, 389-ds-base, python3-lib389, grafana-selinux, 389-ds-base-libs, +1 more Red Hat Fuse 7 nodejs-minimatch
    affected: no fix planned “Will not fix”
  • Red Hat Integration Service Registry nodejs-minimatch Red Hat JBoss Data Grid 7 nodejs-minimatch Red Hat JBoss Enterprise Application Platform 6 nodejs-minimatch Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console
    affected: no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ceph, ocs4/mcg-core-rhel8
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces-theia-rhel8-container, devspaces-theia-endpoint-rhel8-container
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-query-rhel8, rhosdt/jaeger-all-in-one-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    affected: no fix available
  • Red Hat Process Automation 7 nodejs-minimatch
    affected: no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-rhel8 Red Hat Satellite 6 rubygem-rabl, tfm-rubygem-rabl
    affected: no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Runtimes 1 on RHEL 8
    fixed: vendor fix RHSA-2023:0471
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.21.1-2.module+el8.7.0+17528+a329cd47, nodejs 14.21.3-1.module+el8.7.0+18531+81d21ca6, nodejs 16.18.1-3.module+el8.7.0+17465+1a1abd74, nodejs 18.12.1-2.module+el8.7.0+17306+fc023f99, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, +14 more
    fixed: vendor fix RHSA-2023:0050
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.18.1-3.el9_1, nodejs-libs 16.18.1-3.el9_1, npm 8.19.2-1.16.18.1.3.el9_1, nodejs-nodemon 2.0.20-2.el9_1, nodejs-full-i18n 16.18.1-3.el9_1, nodejs 18.12.1-1.module+el9.1.0.z+17326+318294bb, +5 more
    fixed: vendor fix RHSA-2023:0321
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs 14.21.3-1.module+el8.4.0+18317+43f5ac16, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-3.module+el8.4.0+18317+43f5ac16, npm 6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16, nodejs-full-i18n 14.21.3-1.module+el8.4.0+18317+43f5ac16
    fixed: vendor fix RHSA-2023:1533
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 14.21.3-1.module+el8.6.0+18532+cbe6f646, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-3.module+el8.6.0+18532+cbe6f646, npm 6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646, nodejs-full-i18n 14.21.3-1.module+el8.6.0+18532+cbe6f646
    fixed: vendor fix RHSA-2023:1742
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.6-4, rhmtc/openshift-velero-plugin-rhel8 v1.7.6-5, rhmtc/openshift-migration-velero-rhel8 v1.7.6-5, rhmtc/openshift-migration-openvpn-rhel8 v1.7.6-5, rhmtc/openshift-migration-registry-rhel8 v1.7.6-5, rhmtc/openshift-migration-rhel8-operator v1.7.6-7, +11 more
    fixed: vendor fix RHSA-2022:9047
  • Red Hat Openshift Data Foundation 4.19 odf4 v4.19-1752649300
    fixed: vendor fix RHSA-2025:11814
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 devspaces 3.24-1760676569
    fixed: vendor fix RHSA-2025:19094

3 more fixed, 16 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

2.28% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm minimatch
<3.0.5
3.0.5

Affected products

  • n/a minimatch

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.