npm/minimatch CVE-2026-27903: high 7.5, EPSS 0.61%
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
Action: Upgrade minimatch to 3.1.3 or later.
npm i minimatch@10.2.3npm i minimatch@9.0.7npm i minimatch@8.0.6npm i minimatch@7.4.8npm i minimatch@6.2.2npm i minimatch@5.1.8npm i minimatch@4.2.5npm i minimatch@3.1.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.0.0 | 10.2.3 | - |
| 9.0.0 | 9.0.7 | - |
| 8.0.0 | 8.0.6 | - |
| 7.0.0 | 7.4.8 | - |
| 6.0.0 | 6.2.2 | - |
| 5.0.0 | 5.1.8 | - |
| 4.0.0 | 4.2.5 | - |
| 0 | 3.1.3 | - |
Fixed versions
| 10.2.3 | 9.0.7 | 8.0.6 | 7.4.8 | 6.2.2 | 5.1.8 | 4.2.5 | 3.1.3 |
Sources
- osv: GHSA-7r86-cg39-jmmj
- https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
- https://nvd.nist.gov/vuln/detail/CVE-2026-27903
- https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
- https://github.com/isaacs/minimatch
CVE-2026-27903 · published · modified · JSON