`minimatch`

Ecosystem:
npm

Package URL:
pkg:npm/minimatch

Total PRs:
25,009 Dependabot PRs

Latest PR:
about 2 hours ago

Unique Repositories:
12,940 repositories

Unique Repos (30 days):
8,118 repositories

Security Advisories

Regular Expression Denial of Service in minimatch

GHSA-hxm2-r34f-qmc5 CVE-2016-10540 HIGH published over 7 years ago • updated 2 days ago

Affected versions of `minimatch` are vulnerable to regular expression denial of service attacks when user input is passed into the `pattern` argume...

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

GHSA-23c5-xmqv-rm74 CVE-2026-27904 HIGH published 12 days ago • updated 6 days ago

### Summary Nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtrackin...

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

GHSA-3ppc-4f35-3m26 CVE-2026-26996 HIGH published 20 days ago • updated 7 days ago

### Summary `minimatch` is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive `*` wildcards f...

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

GHSA-7r86-cg39-jmmj CVE-2026-27903 HIGH published 12 days ago • updated 6 days ago

### Summary `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and...

5.1.6 → 5.1.9 Patch PR

Closed about 2 hours ago 1 comment

chore(deps): bump minimatch and lerna

RocketCommunicationsInc/astro #1476

3.1.2 → 3.1.5 Patch PR

Open about 3 hours ago 3 comments

chore(deps): bump minimatch and serve-handler in /docs

David-Crty/databasement #155

3.1.2 → 3.1.5 Patch PR

Closed about 3 hours ago 1 comment

Bump minimatch

rjeschmi/rjeschmi.github.io #1

3.1.3 → 3.1.5 Patch PR

Closed about 4 hours ago 1 comment

Bump minimatch from 3.1.2 to 3.1.5 in /site

system-fonts/modern-font-stacks #45

3.1.2 → 3.1.5 Patch PR

Closed about 4 hours ago 1 comment

Bump the npm_and_yarn group across 8 directories with 14 updates

100mslive/100ms-react-native #1557

3.1.2 → 3.1.5 Patch PR

Open about 6 hours ago 1 comment

build(deps): bump the npm_and_yarn group across 17 directories with 9 updates

machalliance/Migration-Documentation-AI #43

3.1.2 → 3.1.5 Patch PR

Open about 6 hours ago 1 comment

Bump minimatch from 3.1.2 to 3.1.5 in /xml-transformer

McNamara84/DataCite-XML-Updater #20

3.1.2 → 3.1.5 Patch PR

Closed about 6 hours ago 1 comment

Bump minimatch from 3.1.2 to 3.1.5

cbirdsong/birdsong.dev #38

3.1.2 → 3.1.5 Patch PR

Open about 6 hours ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 5 updates

RomainDECOSTER/scoutquest #21

3.1.2 → 3.1.5 Patch PR

Open about 7 hours ago 12 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates

ischon/DnDCharacterManagement #155

3.1.2 → 3.1.5 Patch PR

Open about 8 hours ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates

ischon/DnDCharacterManagement #151

3.1.2 → 3.1.5 Patch PR

Closed about 8 hours ago 3 comments

chore(deps): Bump the npm_and_yarn group across 9 directories with 2 updates

jcornell3/tamshai-enterprise-ai #202

3.1.2 → 3.1.5 Patch PR

Closed about 8 hours ago 2 comments

Bump minimatch from 3.1.2 to 3.1.3

Kwiket/jets-seatmap-react-lib-pub #154

3.1.2 → 3.1.3 Patch PR

Closed about 9 hours ago 1 comment

deps: bump the npm_and_yarn group across 1 directory with 3 updates

AUo959/aurora-cloudbank-symbolic #486

3.1.2 → 3.1.5 Patch PR

Open about 13 hours ago 23 comments

build(deps): bump minimatch and serve

zazuko/cube-link #247

3.1.2 → 3.1.5 Patch PR

Open about 14 hours ago 1 comment

build(deps): bump minimatch from 3.1.2 to 3.1.5 in /vue-model-api

modelix/modelix.core #2466

3.1.2 → 3.1.5 Patch PR

Closed about 15 hours ago 2 comments

Bump the npm_and_yarn group across 3 directories with 7 updates

augustocristian/asw2324_0 #235

3.1.2 → 3.1.5 Patch PR

Open about 15 hours ago 2 comments

build(deps): bump minimatch in /packages/otelbin-validation-image

dash0hq/otelbin #543

3.1.2 → 3.1.5 Patch PR

Open about 17 hours ago 2 comments

build(deps): Bump the npm_and_yarn group across 1 directory with 9 updates

OsoPanda1/citemesh-roots #2

3.1.2 → 3.1.5 Patch PR

Open about 17 hours ago 1 comment

Bump the npm_and_yarn group across 1 directory with 2 updates

JaonaryRR/CGU_UDT #1

9.0.5 → 9.0.9 Patch PR

Open about 19 hours ago 1 comment

chore(deps-dev): bump minimatch from 9.0.5 to 9.0.9 in /multiple-node-versions-example

GoogleCloudPlatform/cloud-build-samples #388

9.0.5 → 9.0.9 Patch PR

Open about 20 hours ago 2 comments

chore(deps-dev): bump minimatch from 3.1.2 to 3.1.5

jedau/PICKL #159

3.1.2 → 3.1.5 Patch PR

Open 1 day ago 3 comments

chore: Bump minimatch from 5.1.6 to 5.1.9

thenativeweb/eventsourcingdb-merkle #35

5.1.6 → 5.1.9 Patch PR

Closed 1 day ago 1 comment

build(deps): bump minimatch and editorconfig in /web

bcgov/jasper #890

9.0.1 → 9.0.9 Patch PR

Open 1 day ago 1 comment

Bump the npm_and_yarn group across 1 directory with 2 updates

heymumford/redeemflow #30

3.1.2 → 3.1.5 Patch PR

Closed 1 day ago 1 comment

Bump the npm_and_yarn group across 2 directories with 4 updates

Chrispine-1210/MEC #6

9.0.5 → 9.0.9 Patch PR

Closed 1 day ago 2 comments

Bump the npm_and_yarn group across 1 directory with 6 updates

lilaflo/trilium-mcp #2

3.1.2 → 3.1.5 Patch PR

Closed 1 day ago 1 comment

build(deps): bump the npm_and_yarn group across 5 directories with 9 updates

globe-and-citizen/cnc-portal #1657

3.1.2 → 3.1.5 Patch PR

Open 1 day ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates

ForgedApps/mcpflare #14

9.0.5 → 9.0.9 Patch PR

Closed 1 day ago 1 comment

Bump the npm_and_yarn group across 1 directory with 3 updates

mehdiraized/npmax #79

3.1.2 → 3.1.5 Patch PR

Closed 1 day ago 1 comment

Bump minimatch from 3.1.2 to 3.1.5

smtchahal/gta-snap-to-jpg #48

3.1.2 → 3.1.5 Patch PR

Open 1 day ago 1 comment

build(deps-dev): bump minimatch from 3.1.2 to 3.1.5 in /frontend

0b501e7e/smashd #21

3.1.2 → 3.1.5 Patch PR

Open 1 day ago 1 comment

⬆️ Bump minimatch

Juanitte/Ino-UI #18

3.1.2 → 3.1.5 Patch PR

Closed 1 day ago 2 comments

build: bump minimatch in /tests/acceptance

shopware/SwagPayPal #575

3.1.2 → 3.1.5 Patch PR

Closed 1 day ago 2 comments

Bump minimatch from 3.1.2 to 3.1.5 in /src/Exceptionless.Web/ClientApp

exceptionless/Exceptionless #2144

3.1.2 → 3.1.5 Patch PR

Open 1 day ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 13 updates

nchalla3/notes #47

10.2.0 → 10.2.4 Patch PR

Open 1 day ago 1 comment

Bump minimatch from 3.1.2 to 3.1.5

hpi-schul-cloud/schulcloud-server #6177

3.1.2 → 3.1.5 Patch PR

Closed 1 day ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 4 updates

openvanilla/McBopomofoWeb #545

3.1.2 → 3.1.5 Patch PR

Open 1 day ago 1 comment

Bump minimatch

k3lly003/eqg #2

9.0.5 → 9.0.9 Patch PR

Open 1 day ago 1 comment

Bump minimatch and nuxt

OpenLightingProject/open-fixture-library #5522

3.1.2 → 3.1.5 Patch PR

Closed 2 days ago 2 comments

chore(deps): bump minimatch and serve-handler

BlackRoad-OS/blackroad-os-docs #108

5.1.6 → 5.1.9 Patch PR

Open 2 days ago 7 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates

krishnprakash/auth0-account-link-extension #12

3.1.2 → 3.1.5 Patch PR

Closed 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 4 updates

tylerbishopdev/MuseVault #1

3.1.2 → 3.1.5 Patch PR

Open 2 days ago 1 comment

chore(deps): bump minimatch

HathorNetwork/create-hathor-dapp #7

9.0.5 → 9.0.9 Patch PR

Closed 2 days ago 1 comment

Bump the production-dependencies group across 1 directory with 12 updates

rushabhcodes/quartz #63

10.2.0 → 10.2.4 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 8 updates

AKJUS/ai-hedge-fund #3

3.1.2 → 3.1.5 Patch PR

Open 2 days ago 1 comment

chore(deps): bump minimatch from 10.2.3 to 10.2.4

codingworkflow/ai-code-fusion #212

10.2.3 → 10.2.4 Patch PR

Open 2 days ago 2 comments

chore(deps): bump the production-dependencies group across 1 directory with 15 updates

hengkerrusia/pwnthenotes #6

10.2.2 → 10.2.4 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 4 updates

rchalamala/caltech.dev #124

3.1.2 → 3.1.5 Patch PR

Closed 2 days ago 2 comments

Package Details

Name:	`minimatch`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/minimatch`
JSON API:	View JSON

Security Advisories

5

Active advisories

HIGH 5

View All npm Advisories

Package Information

Description:

a glob matcher in javascript

Repository:	https://github.com/isaacs/minimatch
Homepage:	https://github.com/isaacs/minimatch#readme
Latest Release:	`10.0.1` over 1 year ago
Dependent Repos:	2,198,462
Dependent Packages:	9,743
Downloads:	1,223,937,395
Ranking:	Top 0.0126% by dependent repos Top 0.0004% by downloads Top 0.0099% by dependent pkgs

PR Status

Open 10,776 (43.1%)

Merged 240 (1.0%)

Closed 13,858 (55.4%)

PR Types

Removal 48 (0.2%)

Minor 7,031 (28.1%)

Major 652 (2.6%)

Patch 17,117 (68.5%)

minimatch

Security Advisories

Regular Expression Denial of Service in minimatch

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

minimatch ReDoS vulnerability

Recent PRs (filtered by: Patch PRs )

Package Details

Security Advisories

5

Package Information

PR Status

PR Types

`minimatch`