# minimatch (npm) vulnerabilities 6 known vulnerabilities (4 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 11.0.5 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 11.0.5 (Nov 5, 2026), the latest release - Weekly downloads: 951.2M - Dependents: 20.5K - Releases: 151 since 0.0.1 (Jul 16, 2011) - Registry: https://www.npmjs.com/package/minimatch - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-118764: 7.0.0 to 11.0.0 (11.0.1 is outside it) - CVE-2026-27904: 0.0.1 to 3.1.3 (3.1.4 is outside it); 4.0.0 to 4.2.4 (4.2.5 is outside it); 5.0.0 to 5.1.7 (5.1.8 is outside it); 6.0.0 to 6.2.1 (6.2.2 is outside it); 7.0.0 to 7.4.7 (7.4.8 is outside it); 8.0.0 to 8.0.5 (8.0.6 is outside it); 9.0.0 to 9.0.6 (9.0.7 is outside it); 10.0.0 to 10.2.2 (10.2.3 is outside it) - CVE-2026-27903: 0.0.1 to 3.1.2 (3.1.3 is outside it); 4.0.0 to 4.2.4 (4.2.5 is outside it); 5.0.0 to 5.1.7 (5.1.8 is outside it); 6.0.0 to 6.2.1 (6.2.2 is outside it); 7.0.0 to 7.4.7 (7.4.8 is outside it); 8.0.0 to 8.0.5 (8.0.6 is outside it); 9.0.0 to 9.0.6 (9.0.7 is outside it); 10.0.0 to 10.2.2 (10.2.3 is outside it) - CVE-2026-26996: 0.0.1 to 3.1.2 (3.1.3 is outside it); 4.0.0 to 4.2.3 (4.2.4 is outside it); 5.0.0 to 5.1.6 (5.1.7 is outside it); 6.0.0 to 6.2.0 (6.2.1 is outside it); 7.0.0 to 7.4.6 (7.4.7 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it); 9.0.0 to 9.0.5 (9.0.6 is outside it); 10.0.0 to 10.2.0 (10.2.1 is outside it) - CVE-2022-3517: 0.0.1 to 3.0.4 (3.0.5 is outside it) - CVE-2016-10540: 0.0.1 to 3.0.0 (3.0.2 is outside it) ## Advisories (6) ### [CVE-2026-118764](https://cve.now/CVE-2026-118764): minimatch: potential denial of service via globparts amplification - Severity: Medium 6.9 - Published: Oct 29, 2026 - Affected: from 7.0.0, fixed in 11.0.1. - Fixed in 11.0.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 11.0.5, is not affected. - 50% of minimatch downloads last week were affected versions (541.9M). ### [CVE-2026-27904](https://cve.now/CVE-2026-27904): minimatch ReDoS: nested \*() extglobs generate catastrophically backtracking regular expressions - Severity: High 7.5 - Published: Feb 26, 2026 - Affected: from 10.0.0, fixed in 10.2.3; from 9.0.0, fixed in 9.0.7; from 8.0.0, fixed in 8.0.6; from 7.0.0, fixed in 7.4.8; from 6.0.0, fixed in 6.2.2; from 5.0.0, fixed in 5.1.8; from 4.0.0, fixed in 4.2.5; fixed in 3.1.4. - Fixed in 3.1.4 (released Feb 25, 2026, 1 day before disclosure), 4.2.5 (released Feb 25, 2026, 1 day before disclosure), 5.1.8 (released Feb 25, 2026, 1 day before disclosure) and 5 other versions. - The latest release, 11.0.5, is not affected. - 28% of minimatch downloads last week were affected versions (304.9M). ### [CVE-2026-27903](https://cve.now/CVE-2026-27903): minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - Severity: High 7.5 - Published: Feb 26, 2026 - Affected: from 10.0.0, fixed in 10.2.3; from 9.0.0, fixed in 9.0.7; from 8.0.0, fixed in 8.0.6; from 7.0.0, fixed in 7.4.8; from 6.0.0, fixed in 6.2.2; from 5.0.0, fixed in 5.1.8; from 4.0.0, fixed in 4.2.5; fixed in 3.1.3. - Fixed in 3.1.3 (released Feb 22, 2026, 4 days before disclosure), 4.2.5 (released Feb 25, 2026, 1 day before disclosure), 5.1.8 (released Feb 25, 2026, 1 day before disclosure) and 5 other versions. - The latest release, 11.0.5, is not affected. - 28% of minimatch downloads last week were affected versions (303.7M). ### [CVE-2026-26996](https://cve.now/CVE-2026-26996): minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - Severity: High 8.7 - Published: Feb 20, 2026 - Affected: from 10.0.0, fixed in 10.2.1; from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.0.5; from 7.0.0, fixed in 7.4.7; from 6.0.0, fixed in 6.2.1; from 5.0.0, fixed in 5.1.7; from 4.0.0, fixed in 4.2.4; fixed in 3.1.3. - Fixed in 3.1.3 (released Feb 22, 2026, 2 days after disclosure), 4.2.4 (released Feb 22, 2026, 2 days after disclosure), 5.1.7 (released Feb 22, 2026, 2 days after disclosure) and 5 other versions. - The latest release, 11.0.5, is not affected. - 28% of minimatch downloads last week were affected versions (301.2M). ### [CVE-2022-3517](https://cve.now/CVE-2022-3517): A vulnerability was found in the minimatch package. - Severity: High 7.5 - Published: Oct 17, 2022 - Affected: fixed in 3.0.5. - Fixed in 3.0.5 (released Feb 6, 2022, 253 days before disclosure). - The latest release, 11.0.5, is not affected. - 1.2% of minimatch downloads last week were affected versions (12.6M). ### [CVE-2016-10540](https://cve.now/CVE-2016-10540): Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript \`RegExp\` objects. - Severity: Unrated - Published: May 31, 2018 - Affected: fixed in 3.0.2. - Fixed in 3.0.2 (released Jun 17, 2016, 713 days before disclosure). - The latest release, 11.0.5, is not affected. - 0.3% of minimatch downloads last week were affected versions (3.1M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/minimatch Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.