Hi,

The following vulnerability was published for node-minimatch.

CVE-2026-118764[0]:
| minimatch is a minimal matching utility for converting glob
| expressions into JavaScript RegExp objects. Prior to 11.0.1,
| src/index.ts implements firstPhasePreProcess() so that, at
| optimizationLevel 2 or higher, it repeatedly expands attacker-
| controlled **/.. pattern segments inside a fixpoint loop, allowing
| generated globParts entries to be processed and expanded again.
| secondPhasePreProcess() then compares the expanded entries pairwise,
| so a short malicious glob can cause excessive CPU and memory
| consumption during pattern compilation. This issue is fixed in
| version 11.0.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-118764
https://www.cve.org/CVERecord?id=CVE-2026-118764
[1] https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
[2] https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore