[JTW17]

Updates

• Affected products

Comments
The affected range starts too early. The vulnerable code described in this advisory — firstPhasePreProcess(), the /../ globParts cloning (const other = parts.slice(0); other[gs] = ''; globParts.push(other)) and the pairwise partsMatch loop in secondPhasePreProcess() — was introduced in minimatch 7.0.0. It is not present in any 3.x–6.x release.

Verified on 2026-10-31 against the published npm tarballs:

• 3.1.5, 4.2.6, 5.1.9, 6.2.3: no occurrence of firstPhasePreProcess, secondPhasePreProcess, optimizationLevel, globParts.push, other[gs] or partsMatch.
• 7.0.0: firstPhasePreProcess, globParts.push, other[gs] and partsMatch present (optimizationLevel added in 7.1.0).
• 7.4.9, 10.2.6: all of the above present.

Suggested range: >= 7.0.0, < 11.0.1. This removes false positives for the widely used legacy 3.x line (e.g. eslint 9 and its plugins), which cannot move to 11.x because it relies on the callable default export.

[github]

Hi there @isaacs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory