Skip to content
Fencer Intel
medium 6.9

CVE-2026-118764 json

minimatch: potential denial of service via globparts amplification

published 11d ago modified 5d ago also EUVD-2026-113273 , GHSA-g3hv-75wg-m249

cvss
6.9
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

Patch / fix

  • npm minimatch 11.0.1
  • minimatch_project minimatch 11.0.1
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40165+d075e3f2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40153+4d595597
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.8.0+40164+8921ab53

rocky linux advisories RLSA-2026:96226

Is CVE-2026-118764 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-118764 updated cvss 5.9

minimatch: minimatch: Denial of Service via crafted glob pattern expansion

  • Red Hat Cost Management On Premise costmanagement/costmanagement-ui-rhel10 Red Hat Cryostat 4 cryostat/cryostat-openshift-console-plugin-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9, mta/mta-nodejs-external-provider-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Serverless openshift-serverless-1/logic-rhel9-operator Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-main-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat AMQ Broker 7 amq-broker-maven-repository.zip 7.14.1.CR3
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 automation-controller 4.5.37-1.el8ap, python3.11-azure-core 1.34.0-1.el9ap, python3.12-azure-core 1.34.0-2.el9ap, automation-platform-ui 2.6.15-1.el9ap, automation-gateway 2.5.20260923-1.el9ap, python3.11-azure-keyvault 4.2.0-1.el9ap, +13 more Red Hat build of Apache Camel - HawtIO 4 rhbac-4/hawtio-rhel9, rhbac-4/hawtio-gateway-rhel9 Red Hat build of Apache Camel for Spring Boot 4 rhaf-camel-maven-repository.zip 4.18.4.ER6, rhaf-camel-spring-boot-maven-repository.zip 4.18.4.CS6, rhaf-camel-for-springboot-maven-repository.zip 3.5.16.CS2
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Build of Keycloak rhbk-quarkus-dist.zip 26.6.7.CR1, keycloak-operator.redhat-00001.zip 26.6.6, keycloak-operator.redhat-00003.zip 26.6.7
    affected: workaround, no fix available
show 5 more
  • Red Hat Build of Podman Desktop rh-podman-desktop 3c6fc75a2a6cf5bb9b8a667fddcbbf428132badc Red Hat Ceph Storage 4 cockpit-ceph-installer, rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 9 libarrow, parquet-libs Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf 9.0-20240522.1.el9 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9, rhcl-1/rhcl-rhdh-dynamic-plugin-rhel9 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend
    +3 more products
    Red Hat Directory Server 11 389-ds-base 1.4.3.39-29.module+el8dsrv+25089+418ba535 Red Hat Directory Server 12 389-ds-base 2.8.0-7.module+el9dsrv+24844+8988a132 Red Hat Directory Server 13 389-ds-base 3.2.0-7.el10dsrv
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Edge Manager 1 rhem/flightctl-ui-rhel9, rhem/flightctl-ui-rhel10, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-ui-ocp-rhel10
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 7 rhsm-gtk, python-syspurpose, subscription-manager, subscription-manager-gui, subscription-manager-rhsm, subscription-manager-cockpit, +5 more Red Hat Enterprise Linux 8 npm, rls, rust, cargo, clippy, nodejs, +50 more Red Hat Enterprise Linux 9 npm, rust, cargo, clippy, nodejs, grafana, +45 more Red Hat Enterprise Linux 10 grafana 12.4.3-2.el10, linux-sgx 2.26-7.el10, nodejs26 26.1.0-1.el10, rust 1.84.1-1.el10_0.4, intel-igc 2.34.4-2.el10_2, nodejs22 22.23.2-3.el10_2, +4 more Red Hat Enterprise Linux AI (RHEL AI) 3 llvm22 22.1.3-2.el9ai, rust 1.84.1-1.el10_0.4, llvm21 21.1.8-2.1.el9ai, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, +1 more Red Hat Fuse 7 redhat-fuse-sources.zip 7.13.0, redhat-fuse-maven-repository.zip 7.13.0, fuse-karaf.fuse-7_13_0-00012-redhat-00001.zip 7.13.0
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images nodejs25 25.9.0-1.7.hum1, nodejs20 20.20.2-1.3.hum1, grafana13.1 13.1.8-0.5.hum1, nodejs20-lts 20.20.3-1.1.hum1
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 7 jboss-eap-patch.zip 7.4.23, jboss-eap-maven-repository.zip 7.4.23, jboss-eap-runtime-maven-repository.zip 7.4.25, jboss-eap-full-maven-repository.zip 7.4.22.GA-CR1, jboss-eap-incremental-maven-repository.zip 7.4.23 Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-feature-server-rhel9, rhoai/odh-mod-arch-automl-rhel9, +8 more Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel8, openshift4/ose-monitoring-plugin-rhel9, openshift4/nmstate-console-plugin-rhel9, openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-monitoring-plugin-rhel9, openshift5/ose-agent-installer-ui-rhel9 Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9, odf4/odf-console-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces devspaces/udi-rhel9, devspaces/code-rhel9, devspaces/openvsx-rhel9, devspaces/dashboard-rhel9, devspaces/jetbrains-ide-rhel9, devspaces/pluginregistry-rhel9
    affected: workaround, no fix available “Fix deferred”

8 more affected, 2 more fixed, 11 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6d ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm minimatch
>=7.0.0, <11.0.1
11.0.1

Affected products

  • isaacs minimatch

Classification

Weakness
  • CWE-405 Asymmetric Resource Consumption (Amplification)

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.