CVE record
CVE-2016-10540
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.
CVE evidence
Known exploitation
Not listed in fetched KEV catalog
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
high
CVSS 7.5 · CVSS_V3
Affected packages
1
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| minimatch | npm | 3.0.2 |