CVE-2016-10540: Regular Expression Denial of Service in minimatch
Summary
CVE-2016-10540: Regular Expression Denial of Service in minimatch. Affects minimatch versions < 3.0.2. Fixed in 3.0.2. How to fix ↓
Also tracked for
- node-minimatch · Debian:11
The same CVE-2016-10540 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
minimatch is an npm package that provides a utility for matching file paths using glob patterns. It is commonly used in JavaScript applications to perform file matching and filtering operations. The package allows users to specify patterns that are then used to match against file paths. However, versions of minimatch prior to 3.0.2 are vulnerable to regular expression denial of service (ReDoS) attacks when user input is passed into the pattern argument of minimatch(path, pattern) function.
Vulnerability Detail
The vulnerability in minimatch arises from the lack of input validation and sanitization when processing user-supplied patterns. An attacker can exploit this by providing a specially crafted pattern that triggers a ReDoS attack. This can lead to excessive CPU usage and potentially cause a denial of service condition. The proof of concept code provided demonstrates how an attacker can construct a pattern that includes a large number of backslashes and a single character, resulting in a significant slowdown or crash of the application when the pattern is matched against a file path.
How To Fix
Latest published version: 10.2.6 as of 22 Oct 2026
npm install minimatch@10.2.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.2
This is the first release that contains the fix.
npm install minimatch@3.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of minimatch is not feasible, a possible workaround is to implement input validation and sanitization for user-supplied patterns. This can involve limiting the length of the pattern or using a more efficient pattern matching algorithm. However, it is strongly recommended to update to the latest version of minimatch as it provides a comprehensive fix for the vulnerability.
Conclusion
The vulnerability in minimatch can be mitigated by updating to version 3.0.2 or later. It is important to promptly apply the fix to ensure the security and stability of the application. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for minimatch →
FAQ
minimatch is an npm package that provides a utility for matching file paths using glob patterns. It is commonly used in JavaScript applications for file matching and filtering operations.
Regular expression denial of service (ReDoS) is a type of attack that exploits the exponential time complexity of certain regular expressions. By providing a specially crafted input, an attacker can cause the regular expression matching algorithm to take an excessive amount of time, leading to a denial of service condition.
The vulnerability in minimatch can be exploited by an attacker to cause a denial of service condition in affected applications. By providing a malicious pattern, the attacker can trigger a ReDoS attack, resulting in excessive CPU usage and potentially crashing the application.
Yes, updating to minimatch version 3.0.2 or later fixes the vulnerability. This version includes improvements to the pattern matching algorithm that mitigate the ReDoS vulnerability.
If updating to the latest version of minimatch is not possible, implementing input validation and sanitization for user-supplied patterns can serve as a temporary workaround. However, it is strongly recommended to update to the latest version of minimatch as it provides a comprehensive fix for the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for minimatch.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
