CVE-2026-118764: DoS in minimatch globbing

CVE-2026-118764 is a Denial of Service vulnerability in minimatch, a widely-used JavaScript library for converting glob expressions into RegExp objects. The flaw lies in the firstPhasePreProcess() function: at optimization level 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments within a fixed-point loop, generating globParts entries that are then processed and expanded again. The result is uncontrolled CPU and memory consumption during pattern compilation.

The official CVSS score is 6.9 (classified as medium severity by NVD). NVD formally assigned the CVE on October 29, 2026. Minimatch is a highly popular dependency in Node.js and npm ecosystems, integrated into numerous build, testing, and file processing projects. The impact is real: any service accepting unverified glob patterns becomes exposed. A coherent signal comes from GitHub (November 1, 2026), where implementations of the issue have been reported, confirming recognition of the vulnerability within the developer community.

The fix is available in version 11.0.1. Administrators and IT teams must prioritize upgrading minimatch to 11.0.1 or later across all production environments and recursively verify dependencies using npm audit. Risk is highest for systems processing glob patterns from untrusted sources: file uploads, user configuration parsing, dynamic filter construction. Apply the patch urgently and monitor logs for anomalous patterns or resource consumption that could indicate exploitation attempts.