CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

• CWE-405

• https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
• https://github.com/isaacs/minimatch/releases/tag/v11.0.1
• https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118759Kubeflow Pipelines enables users to build and deploy portabl…7.5
• CVE-2026-11876In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-dep…5
• CVE-2026-118760Kubeflow Pipelines enables users to build and deploy portabl…6.5
• CVE-2026-118761Kubeflow Pipelines enables users to build and deploy portabl…7.5
• CVE-2026-118762Monkeytype is a minimalistic and customizable typing test. P…9.3
• CVE-2026-118763sigstore-js provides JavaScript libraries for interacting wi…7.4
• CVE-2026-118765Botan is a C++ cryptography library. From 3.7.0 until 3.13.0…7.3
• CVE-2026-118766Botan is a C++ cryptography library. Prior to 3.13.0, Botan'…6.1
• CVE-2026-118767Botan is a C++ cryptography library. From 1.11.22 until 3.13…4.8
• CVE-2026-118768Botan is a C++ cryptography library. From 1.11.34 until 3.13…5.9
• CVE-2026-118769Botan is a C++ cryptography library. From 2.1.0 until 3.13.0…9.2
• CVE-2026-11877An unauthorized user can modify configuration through API ca…7.5