Skip to content

[Aikido] Fix security issue in minimatch via minor version upgrade from 9.0.5 to 9.0.7#327

Open
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/AIK-10187-update-packages-17657034-6bGG
Open

[Aikido] Fix security issue in minimatch via minor version upgrade from 9.0.5 to 9.0.7#327
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/AIK-10187-update-packages-17657034-6bGG

Conversation

@aikido-autofix
Copy link

@aikido-autofix aikido-autofix bot commented Feb 27, 2026

Upgrade minimatch to fix multiple DoS vulnerabilities: ReDoS from consecutive wildcards, unbounded brace expansion, recursive backtracking with globstars, and catastrophic backtracking in nested extglobs.

✅ 4 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-25547
LOW
[@isaacs/brace-expansion] Unbounded brace range expansion causes denial of service through exponential expansion of repeated numeric ranges, consuming excessive CPU and memory and potentially crashing the process. An attacker can trigger this with a small malicious input pattern.
CVE-2026-26996
LOW
[minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs.
CVE-2026-27903
LOW
[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems.
CVE-2026-27904
LOW
[minimatch] Nested extglobs (*() and +()) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.
🔗 Related Tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

0 participants