tocsin

CVE-2026-27904

1 advisory.

npm/minimatch CVE-2026-27904: high 7.5, EPSS 0.52%

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Action: Upgrade minimatch to 3.1.4 or later.

npm i minimatch@10.2.3
npm i minimatch@9.0.7
npm i minimatch@8.0.6
npm i minimatch@7.4.8
npm i minimatch@6.2.2
npm i minimatch@5.1.8
npm i minimatch@4.2.5
npm i minimatch@3.1.4

Affected

introducedfixedlast affected
10.0.010.2.3-
9.0.09.0.7-
8.0.08.0.6-
7.0.07.4.8-
6.0.06.2.2-
5.0.05.1.8-
4.0.04.2.5-
03.1.4-

Fixed versions

10.2.39.0.78.0.67.4.86.2.25.1.84.2.53.1.4

Sources

CVE-2026-27904 · published · modified · JSON