minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher,
    it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing
    generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the
    expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during
    pattern compilation. This issue is fixed in version 11.0.1. (CVE-2026-118764)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher,     it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing     generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the     expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during     pattern compilation. This issue is fixed in version 11.0.1. (CVE-2026-118764)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478051	SCA: security update for minimatch (GHSA-g3hv-75wg-m249)	Tenable Cloud Security	SCA Checks	Local	medium
478051	SCA: security update for minimatch (GHSA-g3hv-75wg-m249)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
374105	Linux Distros Unpatched Vulnerability : CVE-2026-118764	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-118764

medium

Tenable Plugins

medium

medium

medium