Technical impact
minimatch is a glob matching library that converts glob expressions into JavaScript RegExp objects. In versions prior to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, the internal matchOne function performs unbounded recursive backtracking when a glob pattern contains multiple non‑adjacent GLOBSTAR () segments and the input path does not match. The time complexity grows combinatorially with the number of pattern segments, so a crafted pattern with 11 GLOBSTAR segments and a 30‑segment path can stall the default minimatch() call for five seconds, and 13 GLOBSTAR segments can exceed fifteen seconds. Because no memoization or time limit is applied, an attacker who controls the glob pattern can cause a denial‑of‑service by stalling the Node.js event loop for tens of seconds per invocation.
Affected Systems
Any Node.js application that depends on minimatch 10.2.3 or older is vulnerable. The affected package is minimatch provided by isaacs. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 are known to contain the flaw. The vulnerability manifests when the application passes user‑controlled glob patterns to minimatch—common in build tools such as ESLint, Webpack, or Rollup, in task runners, multi‑tenant services that run shared processes, administrative interfaces that accept ignore rules, and CI/CD pipelines that evaluate user‑supplied configuration files.
Risk and Exploitability
CVSS base score 7.5 indicates high severity, but EPSS is below 1 % and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, implying that widespread exploitation has not yet been observed. Nevertheless, the attack surface is realistic: any environment where a user can supply a glob pattern without authentication can trigger a denial‑of‑service. The lack of a time or recursion budget means the explosion grows rapidly with pattern complexity; a 56‑byte pattern can stall the event loop for five seconds. Attackers can therefore degrade service availability or force throttling in shared or multi‑tenant Node.js deployments.
Github GHSA