# CVE-2016-10540: minimatch regular expression denial of service

Source: https://junglewise.ai/threats/cve-2016-10540-minimatch-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-10-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2016-10540 · Severity: low · CVSS 3 · Published 2018-10-09

minimatch is a popular JavaScript library used for glob pattern matching in file paths and text processing. The vulnerability allows an attacker to cause a denial of service by providing a specially crafted pattern that triggers excessive CPU consumption via catastrophic backtracking in the regular expression engine, potentially freezing or crashing applications that rely on this library.

Technologies: [minimatch (npm)](https://junglewise.ai/threats/technologies/minimatch). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2016-10540 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10540 being exploited in the wild.

**How severe is CVE-2016-10540?** Low severity, with a CVSS score of 3, published 9 October 2018.

**Which products and versions are affected?** minimatch (npm) < 3.0.2.

**Is there a fix for CVE-2016-10540?** A patch was published on 2018-10-09: version 3.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-10540 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-10540?** Check whether you run minimatch (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Regular Expression Denial of Service (ReDoS) vulnerability in the minimatch library's pattern matching logic. The vulnerability exists when user-controlled input is passed to the pattern argument of the minimatch(path, pattern) function. An attacker can craft a malicious pattern (e.g., "[!" followed by a large number of backslashes and "A") that causes pathological backtracking in the regex engine, consuming excessive CPU resources and causing the application to hang. The vulnerability requires network access and no authentication, and affects all versions prior to 3.0.2. The patch was released in version 3.0.2.

## Affected products

- npm minimatch < 3.0.2

## Identifiers

- CVE-2016-10540
- GHSA-hxm2-r34f-qmc5

## Timeline

- 2018-10-09: disclosed
- 2018-10-09: patched: version 3.0.2

## Related threats

- [minimatch ReDoS in glob pattern compilation](https://junglewise.ai/threats/cve-2026-118764-minimatch-is-a-minimal-matching-utility-for-converting-glob)
- [minimatch ReDoS in matchOne via multiple non-adjacent GLOBSTAR segments](https://junglewise.ai/threats/cve-2026-27903-minimatch-redos-in-matchone-via-multiple-non-adjacent-globstar)
- [minimatch ReDoS vulnerability in braceExpand](https://junglewise.ai/threats/cve-2022-3517-minimatch-redos-vulnerability-in-braceexpand)