tocsin

npm/minimatch CVE-2026-26996: high, EPSS 0.60%

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Action: Upgrade minimatch to 3.1.3 or later.

npm i minimatch@10.2.1
npm i minimatch@9.0.6
npm i minimatch@8.0.5
npm i minimatch@7.4.7
npm i minimatch@6.2.1
npm i minimatch@5.1.7
npm i minimatch@4.2.4
npm i minimatch@3.1.3

Affected

introducedfixedlast affected
10.0.010.2.1-
9.0.09.0.6-
8.0.08.0.5-
7.0.07.4.7-
6.0.06.2.1-
5.0.05.1.7-
4.0.04.2.4-
03.1.3-

Fixed versions

10.2.19.0.68.0.57.4.76.2.15.1.74.2.43.1.3

Sources

CVE-2026-26996 · published · modified · JSON