CVE-2026-118764: Asymmetric Resource Consumption and Denial of Service in minimatch Pattern Preprocessing

minimatch is a foundational JavaScript and TypeScript utility used across the Node.js ecosystem to translate glob expressions into regular expressions (RegExp objects) and structured path-matching arrays. It serves as the primary matching engine for file-system traversal tools such as glob, build pipelines, linters, and web application routing frameworks. When applications accept user-supplied filter expressions or file search patterns and pass them to minimatch, the library's pattern compiler becomes directly exposed to untrusted input.

To optimize directory traversal performance, minimatch supports an optimizationLevel configuration option. While levels 0 and 1 perform basic token normalization, setting optimizationLevel to 2 or higher activates multi-pass pattern preprocessing in src/index.ts. This preprocessing stage rewrites complex traversal constructs and eliminates redundant pattern branches before regular expression compilation occurs.

In versions of minimatch prior to 11.0.1, this multi-pass preprocessor contains an asymmetric resource consumption flaw classified under CWE-405. Specifically, the firstPhasePreProcess() method expands **/.. path segments without enforcing an upper bound on the resulting pattern array size, while the subsequent secondPhasePreProcess() method executes an unguarded quadratic deduplication loop over the expanded array.

When an attacker provides a compact glob string containing consecutive **/.. sequences, the pattern set grows exponentially at a rate of $2^N$ and is immediately subjected to $O(M^2)$ pairwise comparisons. Because Node.js executes JavaScript on a single-threaded event loop, this synchronous computational spike halts request processing across the entire application instance or terminates the process via an out-of-memory fault.

The root cause of CVE-2026-118764 resides in the interaction between two sequential methods within the Minimatch class in src/index.ts: firstPhasePreProcess() and secondPhasePreProcess(). Both methods are invoked during pattern compilation when this.options.optimizationLevel is configured to 2 or greater. Their objective is to normalize globstar-parent traversal patterns (**/..) so that downstream file-system walkers can prune directory trees accurately.

During firstPhasePreProcess(globParts: string[][]), the engine searches each pattern array for the sequence <pre>/**/../<p>/<rest>, where <p> is a valid path segment other than ., .., **, or an empty string ''. Because ** does not follow symbolic links in minimatch semantics, <pre>/**/../<p>/<rest> is transformed into the equivalent brace-expanded representation <pre>/{..,**}/<p>/<rest>. In memory, the function achieves this by cloning the current pattern array, replacing **/.. with .. in one copy and ** in the second copy, and appending the new branch to globParts.

This splitting logic executes inside a do { ... } while (didSomething) fixpoint loop that iterates until no reducible **/.. sequences remain across any entry in globParts. Because each split duplicates the remainder of the pattern—including any unvisited **/.. segments further down the path—a pattern containing $N$ consecutive **/../<p> segments doubles the size of globParts at every expansion step, yielding $M = 2^N$ distinct patterns. Prior to version 11.0.1, although minimatch enforced a braceExpandMax limit (defaulting to 100,000) during initial {a,b} brace expansion, firstPhasePreProcess() failed to consult braceExpandMax when performing **/.. splits.

Once firstPhasePreProcess() completes, the inflated globParts array is passed directly to secondPhasePreProcess(globParts: string[][]). This second phase removes redundant patterns by running a nested loop (for (let i = 0; i < globParts.length - 1; i++) and for (let j = i + 1; j < globParts.length; j++)) that calls this.partsMatch(globParts[i], globParts[j]) on every unique pair. For an array of size $M$, this requires $\frac{M(M - 1)}{2}$ invocations of partsMatch(). When $M$ reaches tens or hundreds of thousands of elements via firstPhasePreProcess() or standard brace expansion, the quadratic execution time stalls the CPU prior to memory exhaustion.

Commit 77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8 addresses both stages of the amplification chain in src/index.ts. In the vulnerable implementation of firstPhasePreProcess(), the inner loop checked whether the path segments surrounding **/.. were eligible for splitting, but never verified the current length of globParts against any resource cap.

// Vulnerable implementation in src/index.ts (prior to 11.0.1)
firstPhasePreProcess(globParts: string[][]) {
  let didSomething = false
  do {
    didSomething = false
    for (let i = 0; i < globParts.length; i++) {
      const parts = globParts[i]
      // ... segment iteration ...
      if (
        !p ||
        p === '.' ||
        p === '..' ||
        !p2 ||
        p2 === '.' ||
        p2 === '..'
        // Missing check on globParts.length allows unbounded 2^N growth
      ) {
        continue
      }
      // Splits parts into two branches and pushes to globParts
      didSomething = true
    }
  } while (didSomething)
}

In the patched version (11.0.1), firstPhasePreProcess() extracts braceExpandMax from this.options (defaulting to 100_000) and halts further **/.. splitting as soon as globParts.length >= braceExpandMax. Simultaneously, secondPhasePreProcess() introduces a hard ceiling of 1000 patterns, bypassing the $O(M^2)$ deduplication loop entirely if globParts.length > 1000.

// Patched implementation in src/index.ts (v11.0.1 - commit 77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8)
firstPhasePreProcess(globParts: string[][]) {
  // each **/.. split doubles the patterns, so stop at the brace max
  const { braceExpandMax = 100_000 } = this.options
  let didSomething = false
  do {
    didSomething = false
    for (let i = 0; i < globParts.length; i++) {
      const parts = globParts[i]
      // ... segment iteration ...
      if (
        !p ||
        p === '.' ||
        p === '..' ||
        !p2 ||
        p2 === '.' ||
        p2 === '..' ||
        globParts.length >= braceExpandMax // Enforces upper bound on pattern splitting
      ) {
        continue
      }
      // ... pattern splitting logic ...
    }
  } while (didSomething)
}
 
secondPhasePreProcess(globParts: string[][]): string[][] {
  // each pattern is compared to each other one, so skip this for
  // large sets. The patterns match the same paths either way.
  if (globParts.length > 1000) return globParts
  for (let i = 0; i < globParts.length - 1; i++) {
    for (let j = i + 1; j < globParts.length; j++) {
      const matched = this.partsMatch(globParts[i], globParts[j])
      // ...
    }
  }
}

> [!NOTE] > Assessment of Fix Completeness: The patch effectively neutralizes both the exponential memory expansion in firstPhasePreProcess() and the quadratic CPU bottleneck in secondPhasePreProcess(). Notably, capping secondPhasePreProcess() at 1,000 patterns also closes a secondary vector where an attacker could use standard brace expansion (e.g., {x,*}/{0..99999}, which stays below the 100,000 braceExpandMax limit) to feed 100,000 patterns directly into the $O(M^2)$ deduplication loop. However, generating 100,000 patterns via braceExpandMax still incurs non-trivial linear allocation overhead; security-sensitive applications processing untrusted globs should explicitly configure a lower braceExpandMax value.

Exploiting CVE-2026-118764 requires two specific preconditions: the target application must pass attacker-controlled strings into minimatch(target, pattern, options) or new Minimatch(pattern, options), and the options object must specify optimizationLevel: 2 (or a higher integer). No authentication or special privileges are required if the pattern input is exposed via a public API endpoint, CLI service, or configuration parser.

To trigger the vulnerability, an attacker constructs a glob string containing repeated sequences of **/../<dir1>/<dir2>. Two trailing path segments (a/b) are used after each **/.. to satisfy the adjacency conditions (p and p2 checks) inside firstPhasePreProcess(). With $N = 20$ repetitions (a string of approximately 200 bytes), firstPhasePreProcess() generates $2^{20} = 1,048,576$ pattern arrays, which then require approximately $5.49 \times 10^{11}$ pairwise comparisons in secondPhasePreProcess().

const { Minimatch } = require('minimatch');
 
// Construct a 299-character payload containing 30 repetitions of '**/../a/b'
// In vulnerable versions (< 11.0.1), this attempts to expand into 2^30 (1,073,741,824) patterns
const maliciousPattern = Array(30).fill('**/../a/b').join('/');
 
console.log(`Payload length: ${maliciousPattern.length} bytes`);
console.time('Compilation Time');
 
try {
  // Must be invoked with optimizationLevel >= 2 to enter firstPhasePreProcess()
  const mm = new Minimatch(maliciousPattern, { optimizationLevel: 2 });
  console.timeEnd('Compilation Time');
  console.log(`Compiled pattern set length: ${mm.set.length}`);
} catch (err) {
  console.error('Process fault encountered:', err);
}

The regression test added in commit 77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8 (test/preprocess-limits.ts) demonstrates both trigger mechanisms: Array(30).fill('**/../a/b').join('/') for exponential **/.. splitting, and {x,*}/{0..999} for large-set deduplication. On versions prior to 11.0.1, executing the 30-segment payload pins a CPU core at 100% utilization and terminates the Node.js runtime with a FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory exception.

The security impact of CVE-2026-118764 is confined to system availability, with no direct impact on confidentiality or integrity (VC:N/VI:N). Because the vulnerability is triggered synchronously during the instantiation of a Minimatch object, any single-threaded Node.js server handling concurrent client requests on the main event loop will become unresponsive for the duration of the pattern compilation or crash entirely if the V8 heap limit is exceeded.

GitHub's security advisory (GHSA-g3hv-75wg-m249) assigns a CVSS v4.0 base score of 6.9 (Medium) with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, reflecting scenarios where availability degradation is partial or mitigated by process supervisors. However, OSV also records a High severity variant (8.7) under the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, which accurately reflects architectures where an unauthenticated network request blocks the primary Node.js event loop and causes complete service denial (VA:H).

According to FIRST EPSS telemetry, CVE-2026-118764 currently holds a low exploitation probability score of 0.00291 (0.291%, 21.74th percentile) and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The primary factor limiting widespread exploitation is that minimatch defaults to optimizationLevel: 1 when no options are provided, meaning only applications or downstream libraries that explicitly opt into optimizationLevel: 2 (or pass user-controlled options objects into minimatch) are vulnerable.

To remediate CVE-2026-118764, upgrade minimatch to version 11.0.1 or later. Version 11.0.1 bounds **/.. expansion in firstPhasePreProcess() to braceExpandMax (100,000 by default) and skips pairwise deduplication in secondPhasePreProcess() whenever the expanded pattern set exceeds 1,000 elements.

# Update minimatch using npm
npm install minimatch@^11.0.1
 
# Verify that no older transitive versions remain in the dependency tree
npm ls minimatch

For environments where an immediate dependency upgrade is not feasible, developers can apply configuration-level workarounds. First, ensure that optimizationLevel is omitted, set to 0, or set to 1 when compiling untrusted glob strings, as the vulnerable preprocessing methods are only executed when optimizationLevel >= 2. Ensure that user input cannot overwrite the options object passed to minimatch.

const { Minimatch } = require('minimatch');
 
// Workaround 1: Restrict optimizationLevel to 1 (default)
const safeMatcher = new Minimatch(untrustedPattern, {
  optimizationLevel: 1,
  braceExpandMax: 1000
});

If optimizationLevel: 2 is strictly required on a patched version (>= 11.0.1) that accepts untrusted input, explicitly lower braceExpandMax from its default of 100,000 to a conservative ceiling such as 500 or 1,000. Additionally, implement pre-validation on user-supplied glob strings to reject inputs exceeding a strict character length (e.g., 256 characters) or containing repeated **/.. traversal sequences.