The vulnerability arises when the minimatch library builds regular expressions from glob patterns that contain nested *() or +() extglobs. These nested unbounded quantifiers create patterns like (?:(?:a|b)*)* that cause catastrophic backtracking in the V8 JavaScript engine. Even a short 12‑byte pattern can stall the engine for several seconds, and adding a single nesting level or a few input characters can increase the time to minutes. The result is a denial of service that can halt applications or services that use minimatch without additional safeguards. The weakness is classified as CWE‑1333, indicating a regular expression denial of service.

The problem affects the isaacs: minimatch package for Node.js versions prior to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4. Any application that depends on these versions, or loads minimatch via its default API with no special options, is susceptible. The issue is not limited to any particular platform but applies wherever the vulnerable library version is imported in a Node.js environment.

With a CVSS score of 7.5, the vulnerability is medium‑high severity. The EPSS score is less than 1 %, indicating that while exploitation is technically possible, it remains low probability under normal circumstances. The vulnerability is not listed in CISA’s KEV catalog, yet the attack vector is straightforward and requires only a crafted glob pattern, which an attacker can supply through any input that eventually flows to minimatch(). Because the default API is vulnerable, legitimate users must guard against malicious patterns or update the library.