Inefficient Algorithmic Complexity in minimatch - #VU165866
Published: November 11, 2026
Vulnerability identifier: #VU165866
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through excessive CPU consumption during pattern compilation.
The vulnerability exists due to inefficient algorithmic complexity in minimatch's mergeRows() function when compiling uncached patterns, as entire rows are repeatedly copied and joined for each wildcard position. A remote attacker can supply long patterns containing wildcard-only path parts separated by /, optionally preceded by a brace group of distinct words, to trigger quadratic compilation work and block applications that compile these patterns.
Affected software
minimatch
Remediation
Install security update from vendor's website.
minimatch - update to 11.0.7