minimatch CVE-2026-118764 (GHSA-g3hv-75wg-m249): denial of service via glob pattern amplification ('**/../' patterns with optimizationLevel >= 2). Which versions are affected and does it matter for my project?

What it is: A medium-severity advisory published 2026-10-30 for minimatch, the glob-matching library used by npm, glob, rimraf, eslint and countless build tools. With optimizationLevel 2 or higher, preprocessing of patterns containing '**/../' could keep generating more pattern entries and then compare them pairwise, so a crafted pattern takes a very long time to process and blocks the Node.js event loop. It only matters where someone else can supply the glob pattern, such as a server or API that accepts user-provided globs, or a multi-tenant build service; patterns written by your own team in config files aren't an attack path. Am I affected: - minimatch below 11.0.1 (the advisory names 10.2.6), when patterns can come from untrusted input and optimizationLevel is 2 or higher. - Check: npm ls minimatch to see all copies (many are old majors pulled in by dev tools), and search your server code for minimatch / glob calls that take patterns from requests. Fix: 1. Upgrade the copy your runtime code uses to minimatch 11.0.1 or later (npm install minimatch@latest, or update the parent package / add an override), then rebuild. 2. Where you accept glob patterns from users, limit their length and complexity, reject '..' segments if you don't need them, and run matching with a timeout or in a worker so one request can't stall the server. 3. Copies used only by local dev tooling on patterns you write yourself are low priority; update them with your normal dependency updates. Verify: npm ls minimatch shows 11.0.1+ for the copies your server uses, and a test with a long '**/../'-heavy pattern returns quickly. Sources: https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249 https://github.com/isaacs/minimatch/releases/tag/v11.0.1 https://nvd.nist.gov/vuln/detail/CVE-2026-118764