Executive brief
minimatch is a widely-used JavaScript library for matching file paths against glob patterns. A flaw in the matchOne() function causes combinatorial backtracking when processing glob patterns with multiple non-adjacent `**` (GLOBSTAR) segments against non-matching paths. An attacker can craft a malicious glob pattern that causes the application to stall for seconds, freezing the entire Node.js event loop and blocking all concurrent users from being served—enabling denial-of-service attacks on build tools, CI/CD pipelines, web servers, and other services that accept user-supplied glob patterns.
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability caused by unbounded recursive backtracking in the matchOne() function at src/index.ts#L960. When a glob pattern contains k non-adjacent GLOBSTAR (`**`) segments and the input path has n segments, the function explores a call tree with O(C(n,k)) complexity—binomial coefficient. For example, k=11 globstars with n=30 path segments causes ~5.4 seconds of stalling; k=13 causes ~15.9 seconds. The vulnerability requires no special options—the default minimatch() API is affected. Attack surface includes build tools (ESLint, Webpack, Rollup), multi-tenant systems with glob-based rules, CI/CD pipelines, and any service accepting user-controlled glob patterns. Patches are available in versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3.
Affected products
- isaacs minimatch >=0.0.0, <3.1.3; >=4.0.0, <4.2.5; >=5.0.0, <5.1.8; >=6.0.0, <6.2.2; >=7.0.0, <7.4.8; >=8.0.0, <8.0.6; >=9.0.0, <9.0.7; >=10.0.0, <10.2.3
Timeline
- 2026-02-26: disclosed: GHSA-7r86-cg39-jmmj published
- 2026-02-25: advisory: GitHub security advisory issued by maintainer