minimatch CVE-2026-118764

Exploitation requires the consuming application to configure minimatch with optimizationLevel >= 2 (the default is 1, so default deployments are not affected) AND to pass attacker-controlled glob pattern strings into pattern compilation. The attacker needs no authentication or privileges and no user interaction once those conditions hold; the trigger is a short glob containing repeated '**/..' segments. Limiting factors that reduce real-world exposure: the optimizationLevel >= 2 setting is opt-in and non-default, the application must expose glob input to untrusted sources, and impact is confined to availability (CPU/memory exhaustion during compilation) with no data compromise.

The vendor CVSS 4.0 score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N and impact confined to availability (VA:H; VC:N/VI:N), which is internally consistent with CWE-405 (asymmetric resource consumption / denial of service) - this is purely a DoS, not information disclosure as the single input Tag claims. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation. The input does not flag a confirmed working PoC, though the GHSA advisory (researcher Reid Downing / b1nv0id) contains a detailed trigger mechanism and the fix commit ships a test that reproduces the amplification (a 30-segment '**/../a/b' pattern expanding to 100,000 globParts), so the barrier to weaponization is low. The vuln.today decision label is 'this_week'. The decisive real-world gate is configuration: the flaw only manifests at optimizationLevel >= 2, which is NOT the minimatch default (default is 1), so despite the product's ubiquity most deployments are not exposed unless they explicitly opt into aggressive optimization AND pass attacker-controlled glob strings to the compiler. Net: a genuine, easy-to-trigger DoS for the subset of applications using optimizationLevel >= 2 on untrusted patterns, meriting prompt patching consistent with the 'this_week' label, but not an emergency given availability-only impact, no KEV, and the non-default precondition.

An application that compiles user-supplied glob patterns with minimatch configured at optimizationLevel >= 2 (e.g., a search, file-filter, or upload-rule API) receives a short crafted pattern of repeated '**/../' segments. firstPhasePreProcess() repeatedly clones and re-expands these segments in its fixpoint loop, inflating globParts up to ~100,000 entries, after which secondPhasePreProcess() performs quadratic pairwise comparisons, consuming minutes of CPU and large memory and stalling the service. No standalone weaponized exploit is cited in the input, but the GHSA advisory describes the mechanism and the fix commit includes a reproducing test pattern.