CVE-2016-10540 Regular Expression Denial of Service in minimatch
HighCVSS 7.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm minimatch(npm) | < 3.0.2 | 3.0.2 |
| debian/node-minimatch(Debian:12) | < 3.0.3-1 | 3.0.3-1 |
| debian/node-minimatch(Debian:13) | < 3.0.3-1 | 3.0.3-1 |
| debian/node-minimatch(Debian:14) | < 3.0.3-1 | 3.0.3-1 |
| minimatch project minimatch | <= 3.0.1 | No fix listed |
| HackerOne minimatch node module | = <=3.0.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- www.npmjs.com
- Debian Security Tracker CVE-2016-10540 vendor-advisory
- nodesecurity.io exploit third-party-advisory