The flaw resides in minimatch's handling of glob expressions. When the optimizer is set to level 2 or higher, the library repeatedly expands attacker‑supplied /.. segments in a loop, producing a growing set of glob parts. A short malicious pattern can therefore trigger excessive CPU cycles and memory usage during compilation, which can lead to a denial‑of‑service condition for the Node.js process that uses minimatch.

Applications that depend on the npm package minimatch provided by the isaacs maintainer are affected. Any installation of minimatch earlier than version 11.0.1 is vulnerable, regardless of the operating system, because the issue is in the JavaScript library itself.

With a CVSS score of 8.7 this vulnerability is considered high severity. The EPSS score is not published, and the vulnerability is not listed in CISA KEV, suggesting no currently known active exploits. The attack vector involves supplying a crafted glob pattern to the library, which is feasible when the application accepts glob syntax from users, from configuration files, or from network input. If exploited, the malicious actor can exhaust system resources and bring the application offline.