{"action":"Upgrade minimatch to 3.1.3 or later.","affected":[{"fixed":"10.2.1","introduced":"10.0.0"},{"fixed":"9.0.6","introduced":"9.0.0"},{"fixed":"8.0.5","introduced":"8.0.0"},{"fixed":"7.4.7","introduced":"7.0.0"},{"fixed":"6.2.1","introduced":"6.0.0"},{"fixed":"5.1.7","introduced":"5.0.0"},{"fixed":"4.2.4","introduced":"4.0.0"},{"fixed":"3.1.3","introduced":"0"}],"component":"minimatch","cve_ids":["CVE-2026-26996"],"ecosystem":"npm","epss":0.00598,"exploited":false,"fixed_versions":["10.2.1","9.0.6","8.0.5","7.4.7","6.2.1","5.1.7","4.2.4","3.1.3"],"ghsa_id":"GHSA-3ppc-4f35-3m26","id":"tcs_01M5KEXXPE0TEM511Z6VM3CX8M","modified_at":"2026-09-10T03:50:33.812431744Z","published_at":"2026-02-18T22:38:11Z","references":["https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://nvd.nist.gov/vuln/detail/CVE-2026-26996","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-3ppc-4f35-3m26","url":"https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26"}],"summary":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern"}