npmPackage

minimatch

6 known vulnerabilities (4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 11.0.5 (Nov 5, 2026): no advisory affects it
Newest unaffected release: 11.0.5 (Nov 5, 2026), the latest release
Advisories: 6 · 4 high, 1 medium

Weekly downloads: 951.2M
Dependents: 20.5K
Releases: 151 since 0.0.1 (Jul 16, 2011)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-118764
Affects 7.0.0 to 11.0.0 (11.0.1 is outside it)
CVE-2026-27904
Affects 0.0.1 to 3.1.3 (3.1.4 is outside it); 4.0.0 to 4.2.4 (4.2.5 is outside it); 5.0.0 to 5.1.7 (5.1.8 is outside it); 6.0.0 to 6.2.1 (6.2.2 is outside it); 7.0.0 to 7.4.7 (7.4.8 is outside it); 8.0.0 to 8.0.5 (8.0.6 is outside it); 9.0.0 to 9.0.6 (9.0.7 is outside it); 10.0.0 to 10.2.2 (10.2.3 is outside it)
CVE-2026-27903
Affects 0.0.1 to 3.1.2 (3.1.3 is outside it); 4.0.0 to 4.2.4 (4.2.5 is outside it); 5.0.0 to 5.1.7 (5.1.8 is outside it); 6.0.0 to 6.2.1 (6.2.2 is outside it); 7.0.0 to 7.4.7 (7.4.8 is outside it); 8.0.0 to 8.0.5 (8.0.6 is outside it); 9.0.0 to 9.0.6 (9.0.7 is outside it); 10.0.0 to 10.2.2 (10.2.3 is outside it)
CVE-2026-26996
Affects 0.0.1 to 3.1.2 (3.1.3 is outside it); 4.0.0 to 4.2.3 (4.2.4 is outside it); 5.0.0 to 5.1.6 (5.1.7 is outside it); 6.0.0 to 6.2.0 (6.2.1 is outside it); 7.0.0 to 7.4.6 (7.4.7 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it); 9.0.0 to 9.0.5 (9.0.6 is outside it); 10.0.0 to 10.2.0 (10.2.1 is outside it)
CVE-2022-3517
Affects 0.0.1 to 3.0.4 (3.0.5 is outside it)
CVE-2016-10540
Affects 0.0.1 to 3.0.0 (3.0.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2026-118764Medium 6.9
minimatch: potential denial of service via globparts amplification
Affected: from 7.0.0, fixed in 11.0.1.
Fixed in 11.0.1 (released Oct 27, 2026, 2 days before disclosure).
The latest release, 11.0.5, is not affected.
50% of minimatch downloads last week were affected versions (541.9M).
CVE-2026-27904High 7.5
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Affected: from 10.0.0, fixed in 10.2.3; from 9.0.0, fixed in 9.0.7; from 8.0.0, fixed in 8.0.6; from 7.0.0, fixed in 7.4.8; from 6.0.0, fixed in 6.2.2; from 5.0.0, fixed in 5.1.8; from 4.0.0, fixed in 4.2.5; fixed in 3.1.4.
Fixed in 3.1.4 (released Feb 25, 2026, 1 day before disclosure), 4.2.5 (released Feb 25, 2026, 1 day before disclosure), 5.1.8 (released Feb 25, 2026, 1 day before disclosure) and 5 other versions.
The latest release, 11.0.5, is not affected.
28% of minimatch downloads last week were affected versions (304.9M).
CVE-2026-27903High 7.5
minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
Affected: from 10.0.0, fixed in 10.2.3; from 9.0.0, fixed in 9.0.7; from 8.0.0, fixed in 8.0.6; from 7.0.0, fixed in 7.4.8; from 6.0.0, fixed in 6.2.2; from 5.0.0, fixed in 5.1.8; from 4.0.0, fixed in 4.2.5; fixed in 3.1.3.
Fixed in 3.1.3 (released Feb 22, 2026, 4 days before disclosure), 4.2.5 (released Feb 25, 2026, 1 day before disclosure), 5.1.8 (released Feb 25, 2026, 1 day before disclosure) and 5 other versions.
The latest release, 11.0.5, is not affected.
28% of minimatch downloads last week were affected versions (303.7M).
CVE-2026-26996High 8.7
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
Affected: from 10.0.0, fixed in 10.2.1; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.0.5; from 7.0.0, fixed in 7.4.7; from 6.0.0, fixed in 6.2.1; from 5.0.0, fixed in 5.1.7; from 4.0.0, fixed in 4.2.4; fixed in 3.1.3.
Fixed in 3.1.3 (released Feb 22, 2026, 2 days after disclosure), 4.2.4 (released Feb 22, 2026, 2 days after disclosure), 5.1.7 (released Feb 22, 2026, 2 days after disclosure) and 5 other versions.
The latest release, 11.0.5, is not affected.
28% of minimatch downloads last week were affected versions (301.2M).
CVE-2022-3517High 7.5
A vulnerability was found in the minimatch package.
Affected: fixed in 3.0.5.
Fixed in 3.0.5 (released Feb 6, 2022, 253 days before disclosure).
The latest release, 11.0.5, is not affected.
1.2% of minimatch downloads last week were affected versions (12.6M).
CVE-2016-10540Unrated
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects.
Affected: fixed in 3.0.2.
Fixed in 3.0.2 (released Jun 17, 2016, 713 days before disclosure).
The latest release, 11.0.5, is not affected.
0.3% of minimatch downloads last week were affected versions (3.1M).