CVE-2026-118764: 
JavaScript vulnerability analysis and mitigation

CVE-2026-118764 is a Denial of Service vulnerability in the minimatch JavaScript library (a glob-to-RegExp utility) caused by uncontrolled amplification during glob pattern compilation. Discovered by researcher Reid Downing (b1nv0id) and disclosed on October 27–29, 2026, it affects all versions of minimatch prior to 11.0.1 (specifically confirmed in 10.2.6). The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat).

The root cause is asymmetric resource consumption (CWE-405) combined with an unchecked loop condition (CWE-606) in src/index.ts. When optimizationLevel is set to 2 or higher, firstPhasePreProcess() processes **/.. pattern segments inside a do...while (didSomething) fixpoint loop: each matching segment causes the current globParts entry to be cloned and appended back to the same array, allowing newly generated entries to be re-processed in subsequent iterations, causing exponential growth. The expanded globParts array is then passed to secondPhasePreProcess(), which performs O(n²) pairwise comparisons via nested for loops — so a short attacker-controlled glob such as repeated **/../a/b segments can trigger minutes of CPU and memory consumption during pattern compilation (GitHub Advisory, Patch Commit).

Successful exploitation causes excessive CPU and memory consumption in any application that passes attacker-controlled input to the minimatch library for glob pattern compilation, potentially crashing the process or severely degrading service availability. There is no confidentiality or integrity impact — the vulnerability is purely a Denial of Service affecting availability. Given minimatch's widespread use as a dependency in the Node.js ecosystem, the blast radius extends to any downstream application or service that processes user-supplied glob patterns without sanitization (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is remotely exploitable with no authentication or user interaction required, as long as the attacker can supply a glob pattern to an application using minimatch at optimizationLevel 2 or higher. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a target application: Find a web application or service that accepts user-supplied glob patterns and processes them using the minimatch library (versions prior to 11.0.1) with optimizationLevel >= 2 (the default in affected versions).
2. Craft a malicious glob pattern: Construct a short but deeply nested pattern containing repeated **/../ segments, such as **/../a/b/**/../a/b/**/../a/b/... (e.g., 30 repetitions of **/../a/b joined by /). This pattern is designed to trigger exponential expansion in firstPhasePreProcess().
3. Submit the pattern: Send the crafted glob pattern to the target application via any input vector that results in a call to minimatch() or new Minimatch() — such as a file search API, filter endpoint, or configuration field.
4. Trigger resource exhaustion: The pattern compilation process enters the fixpoint loop, exponentially expanding globParts entries, followed by O(n²) pairwise comparisons in secondPhasePreProcess(), consuming all available CPU and memory and causing the application to hang or crash (GitHub Advisory, Patch Commit).

• Logs: Application logs showing requests with glob pattern parameters containing repeated **/../ segments; Node.js process logs showing unresponsiveness or out-of-memory errors during pattern compilation.
• Process: Node.js process exhibiting sustained 100% CPU usage or rapidly growing memory consumption triggered by a specific API request; process crashes or restarts correlated with glob pattern input.
• Network: Repeated HTTP requests to endpoints that accept glob or file-path filter parameters, particularly with unusually long or repetitive **/.. sequences in query strings or request bodies.

The fix is available in minimatch version 11.0.1, which limits the **/.. expansion in firstPhasePreProcess() to stop once the number of patterns reaches braceExpandMax (default 100,000), and skips secondPhasePreProcess() deduplication for sets larger than 1,000 patterns (GitHub Release, Patch Commit). If an immediate upgrade is not possible, consider lowering optimizationLevel below 2 when instantiating Minimatch, or implementing input validation to reject glob patterns containing **/.. segments before they reach the library. Upgrading to 11.0.1 is the recommended and definitive remediation (GitHub Advisory).

The vulnerability was reported by security researcher Reid Downing (handle: b1nv0id) and credited in the official GitHub Security Advisory (GitHub Advisory). Red Hat tracked the issue via Bugzilla with a high severity rating and assigned it to their Product Security DevOps Team, with a large CC list indicating broad internal impact assessment across Red Hat products (Red Hat Bugzilla). No significant broader media coverage or notable social media commentary has been observed at this time.