Skip to content

[GHSA-3ppc-4f35-3m26] minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern #7024

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jacobwilliams-psycle wants to merge 1 commit into
base: jacobwilliams-psycle/advisory-improvement-7024
Choose a base branch
from
+134 −1
Open

[GHSA-3ppc-4f35-3m26] minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern #7024

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
135 changes: 134 additions & 1 deletion advisories/github-reviewed/2026/02/GHSA-3ppc-4f35-3m26/GHSA-3ppc-4f35-3m26.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3ppc-4f35-3m26",
"modified": "2026-02-20T16:52:14Z",
"modified": "2026-02-20T16:52:16Z",
"published": "2026-02-18T22:38:11Z",
"aliases": [
"CVE-2026-26996"
Expand Down Expand Up @@ -33,6 +33,139 @@
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "minimatch"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
Comment on lines +36 to +45
Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The affected array now contains multiple separate objects for the same package (npm/minimatch) with identical structure. Consider consolidating these into a single affected entry with multiple ranges to reduce duplication and make future edits less error-prone (especially since the ranges are tightly related and should be kept consistent).

Copilot uses AI. Check for mistakes.
{
"introduced": "0"
},
{
"fixed": "9.0.6"
}
]
Comment on lines +46 to +52
Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using "introduced": "0" for each major-line fix range makes the ranges overlap and produces incorrect semantics (e.g., if the vulnerability is “introduced at 0 and fixed in 3.1.3”, then later versions like 9.0.0 would already be considered fixed, contradicting the additional “fixed in 9.0.6” range). Model each maintained major line as a non-overlapping introduced→fixed interval (e.g., introduced 3.0.0 fixed 3.1.3, introduced 4.0.0 fixed 4.2.4, etc.), or otherwise encode explicit re-introductions if that’s truly the case.

Copilot uses AI. Check for mistakes.
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "minimatch"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.5"
}
]
Comment on lines +65 to +71
Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using "introduced": "0" for each major-line fix range makes the ranges overlap and produces incorrect semantics (e.g., if the vulnerability is “introduced at 0 and fixed in 3.1.3”, then later versions like 9.0.0 would already be considered fixed, contradicting the additional “fixed in 9.0.6” range). Model each maintained major line as a non-overlapping introduced→fixed interval (e.g., introduced 3.0.0 fixed 3.1.3, introduced 4.0.0 fixed 4.2.4, etc.), or otherwise encode explicit re-introductions if that’s truly the case.

Copilot uses AI. Check for mistakes.
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "minimatch"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.7"
}
]
Comment on lines +84 to +90
Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using "introduced": "0" for each major-line fix range makes the ranges overlap and produces incorrect semantics (e.g., if the vulnerability is “introduced at 0 and fixed in 3.1.3”, then later versions like 9.0.0 would already be considered fixed, contradicting the additional “fixed in 9.0.6” range). Model each maintained major line as a non-overlapping introduced→fixed interval (e.g., introduced 3.0.0 fixed 3.1.3, introduced 4.0.0 fixed 4.2.4, etc.), or otherwise encode explicit re-introductions if that’s truly the case.

Copilot uses AI. Check for mistakes.
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "minimatch"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.2.1"
}
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "minimatch"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.7"
}
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "minimatch"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.4"
}
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "minimatch"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.3"
}
]
}
]
}
],
"references": [
Expand Down
Loading