CVE-2022-3517: minmatch ReDoS vulnerability
Summary
CVE-2022-3517: minimatch ReDoS vulnerability. Affects minimatch versions < 3.0.5. Fixed in 3.0.5. How to fix ↓
Also tracked for
- node-minimatch · Debian:11
The same CVE-2022-3517 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The minimatch package is an npm package used for pattern matching and globbing file paths. It provides functions like ext, minimatch, Minimatch, defaults, braceExpand, parse, match, and matchOne. The package is widely used in JavaScript applications for tasks such as file searching and filtering. However, a vulnerability has been discovered in the braceExpand function of minimatch, which can lead to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability can result in a Denial of Service (DoS) if exploited.
Vulnerability Detail
The vulnerability in minimatch arises from a flaw in the braceExpand function. By providing specific arguments to this function, an attacker can trigger a ReDoS attack. ReDoS attacks exploit the exponential time complexity of certain regular expressions, causing the matching process to take an excessive amount of time. This can lead to a DoS condition, where the application becomes unresponsive or crashes. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 10.2.6 as of 22 Oct 2026
npm install minimatch@10.2.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.5
This is the first release that contains the fix.
npm install minimatch@3.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to avoid using the braceExpand function with untrusted input. Developers should carefully validate and sanitize any user-supplied input before passing it to the braceExpand function. By ensuring that the input does not contain malicious patterns, the risk of a ReDoS attack can be mitigated.
Conclusion
The minimatch package is vulnerable to a ReDoS attack in the braceExpand function. This can lead to a Denial of Service (DoS) condition in applications that use the package. It is recommended to update the minimatch package to version 3.0.5 or later to fix the vulnerability. If immediate update is not possible, developers should validate and sanitize user input before passing it to the braceExpand function. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for minimatch →
FAQ
The vulnerability can lead to a Denial of Service (DoS) condition in applications that use the minimatch package. An attacker can exploit the vulnerability to cause the application to become unresponsive or crash.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
A ReDoS (Regular Expression Denial of Service) attack is a type of vulnerability where an attacker can exploit the exponential time complexity of certain regular expressions to cause the matching process to take an excessive amount of time. This can lead to a DoS condition in the targeted application.
Yes, a fix is available for this vulnerability. Developers should update the minimatch package to version 3.0.5 or later to mitigate the risk of a ReDoS attack.
If updating the package is not immediately feasible, developers can mitigate the risk by carefully validating and sanitizing user-supplied input before passing it to the braceExpand function. By ensuring that the input does not contain malicious patterns, the risk of a ReDoS attack can be reduced.
References
Related vulnerabilities
Recent vulnerabilities recorded for minimatch.
