Find, fix and prevent vulnerabilities in your code.

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) in the firstPhasePreProcess method, where the **/.. transform clones a globParts entry and pushes the clone back onto the same array inside a do...while (didSomething) fixpoint loop. An attacker can exhaust CPU and memory by supplying a glob pattern whose **/.. sequences regenerate entries during preprocessing, which secondPhasePreProcess then compares in an O(n^2) pairwise partsMatch pass over the expanded set. Exploitation requires the pattern to be parsed with optimizationLevel set to 2 or higher.

Remediation

Upgrade minimatch to version 11.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the walkCB, walkCB2, walkCBSync, and walkCB2Sync methods of src/walker.ts, where each abort branch calls cb() without returning. An attacker can keep a walk consuming filesystem I/O and CPU after it has already been aborted, by driving a traversal that the caller tries to bound, because execution continues past the abort into processPatterns(), readdirCB(), and recursive walkCB2() calls. This affects only callers that rely on the signal option or AbortSignal.timeout() to cancel a walk, and applies to both glob() and globStream().

Remediation

Upgrade glob to version 14.0.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release