Skip to content

[Aikido] Fix 4 security issues in minimatch, ajv#1620

Open
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-17656819-bUBn
Open

[Aikido] Fix 4 security issues in minimatch, ajv#1620
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-17656819-bUBn

Conversation

@aikido-autofix
Copy link
Contributor

Upgrade minimatch and ajv to mitigate critical ReDoS vulnerabilities allowing potential event loop stalling and denial of service attacks via crafted regex patterns.

✅ 4 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-27903
HIGH
[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems.
CVE-2026-26996
LOW
[minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs.
CVE-2026-27904
LOW
[minimatch] Nested extglobs (*() and +()) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.
CVE-2025-69873
LOW
[minimatch] ReDoS vulnerability in JSON schema validation when $data option is enabled allows attackers to inject malicious regex patterns causing catastrophic backtracking and CPU exhaustion, enabling denial of service with minimal payload.

@aikido-autofix aikido-autofix bot requested a review from a team as a code owner February 27, 2026 23:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants