The vulnerability lies in the minimatch library’s handling of glob patterns that include many consecutive asterisks followed by a literal character absent from the target string. Each asterisk expands to its own [^/]*? regex group, and when the match ultimately fails, V8’s regex engine performs exponential backtracking with a time complexity of O(4^N). This can bring an application into a denial‑of‑service state, with N=15 taking around two seconds and N=34 effectively hanging indefinitely. The weakness is a Regular Expression Denial of Service, identified as CWE‑1333.

Products affected are versions 10.2.0 and earlier of minimatch, the minimal matching utility used in Node.js projects. Any application that receives user‑controlled strings and passes them directly to minimatch() as the pattern argument is vulnerable. The library is maintained by the isaacs team.

The CVSS score of 8.7 classifies the vulnerability as high severity. The EPSS score is under 1%, indicating a low probability of exploitation in the wild, and it is not currently listed in the KEV catalog. The most likely attack vector is a malicious user supplying an intentionally crafted glob pattern to a vulnerable application. Exploitation requires no special privileges and could be performed as part of normal usage of the library.