minimatch: Denial of service via amplification of glob parts
The npm package minimatch, which converts glob patterns into JavaScript RegExp objects, can be driven into excessive CPU and memory consumption during pattern compilation. A short, attacker-controlled glob pattern containing **/.. segments triggers repeated expansion at optimizationLevel 2 or higher. The impact is limited to availability, so a vulnerable application may become slow or crash.
isaacs · minimatch
