Vulnerability GHSA-f8q6-p94x-37v3
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 years ago
October 18, 2022 at 12:00 PM UTC
minimatch ReDoS vulnerability
0.0.1 - 3.0.4
0.0.1 - 3.0.4
Summary
minimatch ReDoS vulnerability
Details
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
6 hours ago
minimatch has potential denial of service via globparts amplification
0.0.1 - 11.0.0 GHSA-g3hv-75wg-m249
0.0.1 - 11.0.0 GHSA-g3hv-75wg-m249
High Risk
8 months ago
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
0.0.1 - 3.1.2 and 4.0.0 - 4.2.4 and 5.0.0 - 5.1.7 and 6.0.0 - 6.2.1 and 7.0.0 - 7.4.7 and 8.0.0 - 8.0.5 and 9.0.0 - 9.0.6 and 10.0.0 - 10.2.2 GHSA-7r86-cg39-jmmj
0.0.1 - 3.1.2 and 4.0.0 - 4.2.4 and 5.0.0 - 5.1.7 and 6.0.0 - 6.2.1 and 7.0.0 - 7.4.7 and 8.0.0 - 8.0.5 and 9.0.0 - 9.0.6 and 10.0.0 - 10.2.2 GHSA-7r86-cg39-jmmj
High Risk
8 months ago
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
0.0.1 - 3.1.3 and 4.0.0 - 4.2.4 and 5.0.0 - 5.1.7 and 6.0.0 - 6.2.1 and 7.0.0 - 7.4.7 and 8.0.0 - 8.0.5 and 9.0.0 - 9.0.6 and 10.0.0 - 10.2.2 GHSA-23c5-xmqv-rm74
0.0.1 - 3.1.3 and 4.0.0 - 4.2.4 and 5.0.0 - 5.1.7 and 6.0.0 - 6.2.1 and 7.0.0 - 7.4.7 and 8.0.0 - 8.0.5 and 9.0.0 - 9.0.6 and 10.0.0 - 10.2.2 GHSA-23c5-xmqv-rm74
High Risk
8 months ago
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
0.0.1 - 3.1.2 and 4.0.0 - 4.2.3 and 5.0.0 - 5.1.6 and 6.0.0 - 6.2.0 and 7.0.0 - 7.4.6 and 8.0.0 - 8.0.4 and 9.0.0 - 9.0.5 and 10.0.0 - 10.2.0 GHSA-3ppc-4f35-3m26
0.0.1 - 3.1.2 and 4.0.0 - 4.2.3 and 5.0.0 - 5.1.6 and 6.0.0 - 6.2.0 and 7.0.0 - 7.4.6 and 8.0.0 - 8.0.4 and 9.0.0 - 9.0.5 and 10.0.0 - 10.2.0 GHSA-3ppc-4f35-3m26
High Risk
8 years ago
Regular Expression Denial of Service in minimatch
0.0.1 - 3.0.0 GHSA-hxm2-r34f-qmc5
0.0.1 - 3.0.0 GHSA-hxm2-r34f-qmc5
Impacted packages
Timeline
Published
4 years ago
October 18, 2022 at 12:00 PM UTC
Fixed (3.0.5)
4 years ago
February 06, 2022 at 08:28 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:49 AM UTC