isaacs minimatch
4 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118764 | < 11.0.1 | minimatch: potential denial of service via globparts amplification | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-27904 | >= 10.0.0, < 10.2.3 ; >= 9.0.0, < 9.0.7 ; >= 8.0.0, < 8.0.6 ; … | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions | HIGH 7.5 | 0.5 % | ||
| CVE-2026-27903 | >= 10.0.0, < 10.2.3 ; >= 9.0.0, < 9.0.7 ; >= 8.0.0, < 8.0.6 ; … | minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments | HIGH 7.5 | 0.6 % | ||
| CVE-2026-26996 | < 10.2.1 | minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern | HIGH 8.7 | 0.6 % |