Skip to content
Fencer Vulns
medium 6.9

CVE-2026-118764 json

minimatch: potential denial of service via globparts amplification

published 2026-10-29 10 d ago modified 2026-11-04 4 d ago also GHSA-g3hv-75wg-m249 , EUVD-2026-113273

cvss
6.9
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

Patch / fix

  • npm minimatch 11.0.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-118764 updated cvss 5.9

minimatch: minimatch: Denial of Service via crafted glob pattern expansion

  • Red Hat Cost Management On Premise costmanagement/costmanagement-ui-rhel10 Red Hat Cryostat 4 cryostat/cryostat-openshift-console-plugin-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9, mta/mta-nodejs-external-provider-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Serverless openshift-serverless-1/logic-rhel9-operator Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-main-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat AMQ Broker 7 amq-broker-maven-repository.zip 7.14.1.CR3
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 automation-controller 4.5.37-1.el8ap, python3.11-azure-core 1.34.0-1.el9ap, python3.12-azure-core 1.34.0-2.el9ap, automation-platform-ui 2.6.15-1.el9ap, automation-gateway 2.5.20260923-1.el9ap, python3.11-azure-keyvault 4.2.0-1.el9ap, +13 more Red Hat build of Apache Camel - HawtIO 4 rhbac-4/hawtio-rhel9, rhbac-4/hawtio-gateway-rhel9 Red Hat build of Apache Camel for Spring Boot 4 rhaf-camel-maven-repository.zip 4.18.4.ER6, rhaf-camel-spring-boot-maven-repository.zip 4.18.4.CS6, rhaf-camel-for-springboot-maven-repository.zip 3.5.16.CS2
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Build of Keycloak rhbk-quarkus-dist.zip 26.6.7.CR1, keycloak-operator.redhat-00001.zip 26.6.6, keycloak-operator.redhat-00003.zip 26.6.7
    affected: workaround, no fix available
show 5 more
  • Red Hat Build of Podman Desktop rh-podman-desktop 3c6fc75a2a6cf5bb9b8a667fddcbbf428132badc Red Hat Ceph Storage 4 cockpit-ceph-installer, rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 9 libarrow, parquet-libs Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf 9.0-20240522.1.el9 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9, rhcl-1/rhcl-rhdh-dynamic-plugin-rhel9 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend
    +3 more products
    Red Hat Directory Server 11 389-ds-base 1.4.3.39-29.module+el8dsrv+25089+418ba535 Red Hat Directory Server 12 389-ds-base 2.8.0-7.module+el9dsrv+24844+8988a132 Red Hat Directory Server 13 389-ds-base 3.2.0-7.el10dsrv
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Edge Manager 1 rhem/flightctl-ui-rhel9, rhem/flightctl-ui-rhel10, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-ui-ocp-rhel10
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 7 rhsm-gtk, python-syspurpose, subscription-manager, subscription-manager-gui, subscription-manager-rhsm, subscription-manager-cockpit, +5 more Red Hat Enterprise Linux 8 npm, rls, rust, cargo, clippy, nodejs, +50 more Red Hat Enterprise Linux 9 npm, rust, cargo, clippy, nodejs, grafana, +45 more Red Hat Enterprise Linux 10 grafana 12.4.3-2.el10, linux-sgx 2.26-7.el10, nodejs26 26.1.0-1.el10, rust 1.84.1-1.el10_0.4, intel-igc 2.34.4-2.el10_2, nodejs22 22.23.2-3.el10_2, +4 more Red Hat Enterprise Linux AI (RHEL AI) 3 llvm22 22.1.3-2.el9ai, rust 1.84.1-1.el10_0.4, llvm21 21.1.8-2.1.el9ai, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, +1 more Red Hat Fuse 7 redhat-fuse-sources.zip 7.13.0, redhat-fuse-maven-repository.zip 7.13.0, fuse-karaf.fuse-7_13_0-00012-redhat-00001.zip 7.13.0
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images nodejs25 25.9.0-1.7.hum1, nodejs20 20.20.2-1.3.hum1, grafana13.1 13.1.8-0.5.hum1, nodejs20-lts 20.20.3-1.1.hum1
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 7 jboss-eap-patch.zip 7.4.23, jboss-eap-maven-repository.zip 7.4.23, jboss-eap-runtime-maven-repository.zip 7.4.25, jboss-eap-full-maven-repository.zip 7.4.22.GA-CR1, jboss-eap-incremental-maven-repository.zip 7.4.23 Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-feature-server-rhel9, rhoai/odh-mod-arch-automl-rhel9, +8 more Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel8, openshift4/ose-monitoring-plugin-rhel9, openshift4/nmstate-console-plugin-rhel9, openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-monitoring-plugin-rhel9, openshift5/ose-agent-installer-ui-rhel9 Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9, odf4/odf-console-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces devspaces/udi-rhel9, devspaces/code-rhel9, devspaces/openvsx-rhel9, devspaces/dashboard-rhel9, devspaces/jetbrains-ide-rhel9, devspaces/pluginregistry-rhel9
    affected: workaround, no fix available “Fix deferred”

8 more affected, 1 more fixed, 11 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5 d ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm minimatch
>=7.0.0, <11.0.1
11.0.1

Affected products

  • isaacs minimatch

Classification

Weakness
  • CWE-405 Asymmetric Resource Consumption (Amplification)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.