[GHSA-g3hv-75wg-m249] minimatch has potential denial of service via globparts amplification

advisories/github-reviewed/2026/10/GHSA-g3hv-75wg-m249/GHSA-g3hv-75wg-m249.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g3hv-75wg-m249",
-  "modified": "2026-10-30T23:09:55Z",
+  "modified": "2026-10-30T23:09:56Z",
   "published": "2026-10-30T23:09:55Z",
   "aliases": [
     "CVE-2026-118764"
   ],
   "summary": "minimatch has potential denial of service via globparts amplification",
-  "details": "minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.\n\nresearcher: Reid Downing (b1nv0id)\nfiles: \n\n- src/index.ts: 690-770\n- src/index.ts: 780-796\n\nissue:\ninput-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.\n\nthe **/../ transformation clones a globparts entry and appends the clone to the same globparts array:\n```\nparts.splice(gs, 1)\nconst other = parts.slice(0)\nother[gs] = '**'\nglobParts.push(other)\n```\nthis occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.\n\nthe expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:\n```\nfor (let i = 0; i < globParts.length - 1; i++) {\n  for (let j = i + 1; j < globParts.length; j++) {\n    this.partsMatch(...)\n  }\n}\n```\nan attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.",
+  "details": "minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.\n\nresearcher: Reid Downing (b1nv0id)\nfiles: \n\n- src/index.ts: 690-770\n- src/index.ts: 780-796\n\nissue:\ninput-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.\n\nthe **/../ transformation clones a globparts entry and appends the clone to the same globparts array:\n```\nparts.splice(gs, 1)\nconst other = parts.slice(0)\nother[gs] = '**'\nglobParts.push(other)\n```\nthis occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.\n\nthe expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:\n```\nfor (let i = 0; i < globParts.length - 1; i++) {\n  for (let j = i + 1; j < globParts.length; j++) {\n    this.partsMatch(...)\n  }\n}\n```\nan attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.\n\n### Legacy-version scope clarification requested\n\nThe mechanism above is described for 10.2.6. Inspection of the published CommonJS entry points for 3.1.5 and 5.1.9 does not find firstPhasePreProcess, secondPhasePreProcess, or optimizationLevel. Please confirm whether these legacy lines are affected through another mechanism, or whether the affected-version range needs refinement. Absence of these identifiers alone does not establish that a release is safe. The existing affected range and severity are retained pending maintainer/curator confirmation.",
   "severity": [
     {
       "type": "CVSS_V4",
@@ -55,6 +55,22 @@
     {
       "type": "WEB",
       "url": "https://github.com/isaacs/minimatch/releases/tag/v11.0.1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://registry.npmjs.org/exceljs/4.4.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://registry.npmjs.org/minimatch/10.2.6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://registry.npmjs.org/minimatch/3.1.5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://registry.npmjs.org/minimatch/5.1.9"
     }
   ],
   "database_specific": {