[ramonpzg]

Summary

Corrects the affected npm range for minimatch from < 11.0.1 to >= 7.0.0, < 11.0.1.

Evidence

The advisory describes amplification in Minimatch.firstPhasePreProcess() followed by quadratic work in Minimatch.secondPhasePreProcess() when optimizationLevel is 2 or higher. Those methods were introduced in minimatch 7.0.0 and do not exist in earlier releases, including the maintained 5.1.9 and 6.2.3 lines.

The fix in isaacs/minimatch@77a0f5c changes those two methods by limiting the patterns created and bounding the second preprocessing phase. Releases from 7.0.0 through 11.0.0 contain both methods without those limits; 11.0.1 contains the fix.

This change leaves the patched version at 11.0.1 and only corrects the introduced version.

[jan-lymonero]

Independent source review supports changing the introduced version from 0 to 7.0.0, while retaining the fix at 11.0.1.

Public tagged-source evidence:

• v3.1.5, minimatch.js and v5.1.9, minimatch.js split each brace-expanded pattern into path parts without the recursive preprocessing/amplification described by this advisory. Neither has firstPhasePreProcess, secondPhasePreProcess or optimizationLevel.
• v6.2.3, src/index.ts likewise lacks those preprocessing methods.
• Introduction commit 297b6c1 adds the preprocessing; v7.0.0 contains the repeated globParts.push(other) expansion followed by the second preprocessing pass.
• Fix commit 77a0f5c adds the limits; v11.0.1 contains them.

One qualification to the PR explanation: v7.0.0 runs this preprocessing without an optimizationLevel gate. The optimizationLevel >= 2 condition appears in v7.1.0. This does not change the proposed range, but is relevant if the advisory description is clarified.

The legacy-version conclusion rests on absence of the vulnerable code, rather than on application-specific reachability.

[nitinthakurcode]

Execution evidence supporting introduced: 7.0.0 (complements the source review above, and answers the "absence of identifiers alone does not establish safety" point in #10809).

Method: each original npm tarball, loaded in its own Node process with a 64 MiB V8 old-space limit and a 5 s timeout. The pattern is the advisory's own **/../ construction repeated N times, passed to new Minimatch(pattern, { optimizationLevel }); the result is the number of compiled patterns. Measured 2026-10-31.

version	level 1 (default), N=20	level 2, N=4	level 2, N=20
3.1.5	1	1	1
5.1.9	1	1	1
6.2.3	1	1	1
7.0.0	heap limit (SIGABRT)	16	heap limit (SIGABRT)
7.0.1	heap limit (SIGABRT)	16	heap limit (SIGABRT)
7.1.0	1	16	heap limit (SIGABRT)
10.2.6	1	16	heap limit (SIGABRT)

Two observations:

1. No release before 7.0.0 amplifies, so introduced: 7.0.0 matches executed behaviour, not only the absence of firstPhasePreProcess.
2. In 7.0.0 and 7.0.1 the amplification also happens at the default level: preprocessing ran unconditionally until the optimizationLevel option was added in 7.1.0. The advisory text ("when optimizationLevel >= 2") therefore understates those two releases. The range is unaffected, since both are already inside >= 7.0.0, < 11.0.1.

[TheGU]

Evidence for "introduced": "7.0.0" across every published release. The full scan in #10812 went with that PR when it was closed as a duplicate, so here is the same check on this PR, redone on 2026-11-04.

I downloaded all 150 minimatch versions on the npm registry (0.0.1 to 11.0.4, none is a prerelease), checked each tarball against the dist.shasum in the registry metadata (no mismatches) and read the shipped .js, .cjs and .mjs files without executing them.

Releases	Count	firstPhasePreProcess	How it is reached	Growth bound
0.0.1 to 6.2.3	93	absent	not applicable	not applicable
7.0.0, 7.0.1	2	present	always, there is no optimizationLevel option	no
7.1.0 to 11.0.0	51	present	optimizationLevel >= 2, default 1	no
11.0.1 to 11.0.4	4	present	optimizationLevel >= 2, default 1	yes, globParts.length >= braceExpandMax

The 93 include the maintenance releases published in February 2026 (3.1.3 to 3.1.5, 4.2.4 to 4.2.6, 5.1.7 to 5.1.9, 6.2.1 to 6.2.3), so those releases did not carry the code into the older lines. This supports the range proposed here, >= 7.0.0, < 11.0.1.

I then ran the first release with the method against the last 6.x release. new Minimatch('**/../a/b/'.repeat(12) + 'x', { optimizationLevel: 2 }) gives set.length 4096 on 7.0.0 and 1 on 6.2.3 (Node 26.4.0). Neither version has that option, so default options give the same counts.

This is about the mechanism this advisory describes. It is not a claim that releases before 7.0.0 are free of other denial of service issues.

[advisory-database]

Hi @ramonpzg! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!