minimatch has potential denial of service via globparts amplification

[ Description ]Official description

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

[ Fixes ]Fixes and patches

• minimatch 11.0.1Fixed version · GitHub Advisories · npm package minimatch: upgrade to 11.0.1 or later (affected >= 7.0.0, < 11.0.1)

[ Packages ]Affected open-source packages

• minimatch npmAffected >= 7.0.0, < 11.0.1 · fixed in 11.0.1 · GHSA-g3hv-75wg-m249

[ References ]References

• github.com/isaacs/minimatch/commit/297b6c1a01f2410b3ba1ebed14ba222d0c3c1033
• github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8
• github.com/isaacs/minimatch/commit/fd0b3ab9cbc5bf1aff1c99f1f46e413c2b3340da
• github.com/isaacs/minimatch/releases/tag/v11.0.1
• github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249