[Snyk] Security upgrade lerna from 5.6.2 to 8.1.9#815
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-JSYAML-17900054 - https://snyk.io/vuln/SNYK-JS-TAR-17909068 - https://snyk.io/vuln/SNYK-JS-TAR-17909104 - https://snyk.io/vuln/SNYK-JS-TAR-17909152 - https://snyk.io/vuln/SNYK-JS-TAR-17909225
|
This upgrade spans three major versions (v6, v7, v8) and introduces significant breaking changes that will require migration effort. The core philosophy of Lerna has shifted towards leveraging package manager workspaces and the Nx task runner. Key Breaking Changes:
Recommendation:
Source: Lerna Changelog, Legacy Package Management Guide
|
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 16 security issues
Security issues:
- nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (link)
- minimatch: Denial of Service via specially crafted glob patterns (link)
- minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns (link)
- Minimatch: Denial of Service via catastrophic backtracking in glob expressions (link)
- minimatch: Denial of Service via specially crafted glob patterns (link)
- minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns (link)
- Minimatch: Denial of Service via catastrophic backtracking in glob expressions (link)
- minimatch: Denial of Service via specially crafted glob patterns (link)
- minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns (link)
- Minimatch: Denial of Service via catastrophic backtracking in glob expressions (link)
- minimatch: Denial of Service via specially crafted glob patterns (link)
- minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns (link)
- Minimatch: Denial of Service via catastrophic backtracking in glob expressions (link)
- sigstore's
certificateOIDsverification constraints are silently dropped and never enforced (link) - BlueOak-1.0.0: Open-source license could not be identified (link)
- BlueOak-1.0.0: Open-source license could not be identified (link)
Fixed security issues:
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="package-lock.json" line_range="735-740" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2021-3807):** nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
*Source: trivy*
</issue_to_address>
### Comment 2
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-26996):** minimatch: Denial of Service via specially crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
*Source: trivy*
</issue_to_address>
### Comment 3
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-27903):** minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
*Source: trivy*
</issue_to_address>
### Comment 4
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-27904):** Minimatch: Denial of Service via catastrophic backtracking in glob expressions
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
*Source: trivy*
</issue_to_address>
### Comment 5
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-26996):** minimatch: Denial of Service via specially crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
*Source: trivy*
</issue_to_address>
### Comment 6
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-27903):** minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
*Source: trivy*
</issue_to_address>
### Comment 7
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-27904):** Minimatch: Denial of Service via catastrophic backtracking in glob expressions
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
*Source: trivy*
</issue_to_address>
### Comment 8
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-26996):** minimatch: Denial of Service via specially crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
*Source: trivy*
</issue_to_address>
### Comment 9
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-27903):** minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
*Source: trivy*
</issue_to_address>
### Comment 10
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-27904):** Minimatch: Denial of Service via catastrophic backtracking in glob expressions
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
*Source: trivy*
</issue_to_address>
### Comment 11
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-26996):** minimatch: Denial of Service via specially crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
*Source: trivy*
</issue_to_address>
### Comment 12
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-27903):** minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
*Source: trivy*
</issue_to_address>
### Comment 13
<location path="package-lock.json" line_range="1765-1779" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-27904):** Minimatch: Denial of Service via catastrophic backtracking in glob expressions
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
*Source: trivy*
</issue_to_address>
### Comment 14
<location path="package-lock.json" line_range="14070-14086" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-48815):** sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced
### Summary
The documented `certificateOIDs` option in `sigstore.verify()` is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked.
### Details
The public verify options include `certificateOIDs` and the documentation says those OID/value pairs “must be present in the certificate’s extension list.” The policy-construction path used by `sigstore.verify()` and `createVerifier()` only copies the SAN and issuer settings into the verification policy and completely ignores `certificateOIDs`.
As a result, callers can believe they are constraining verification to certificates carrying specific Fulcio or workload-identifying OIDs, while the actual verifier never receives those constraints. Any bundle that satisfies the remaining checks is accepted even if the required OID extensions are absent or mismatched.
This is reachable from supported usage through the documented `certificateOIDs` verify option.
### PoC
```javascript
const { createVerificationPolicy } = require("sigstore/dist/config");
const policy = createVerificationPolicy({
certificateIssuer: "https://issuer.example",
certificateIdentityEmail: "victim@example.com",
certificateOIDs: {
"1.2.3.4": "required-value",
},
});
console.log("certificateOIDs" in policy, JSON.stringify(policy));
// false {"subjectAlternativeName":"victim@example.com","extensions":{"issuer":"https://issuer.example"}}
```
### Impact
Applications that rely on `certificateOIDs` to restrict which certificates may sign artifacts receive no such protection. Unauthorized certificates that should be rejected on extension policy can be accepted as long as they satisfy the remaining verification checks.
*Source: trivy*
</issue_to_address>
### Comment 15
<location path="package-lock.json" line_range="1845-1853" />
<code_context>
</code_context>
<issue_to_address>
**security (license/isexe):** BlueOak-1.0.0: Open-source license could not be identified
The obligations of the `BlueOak-1.0.0` license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
*Source: trivy*
</issue_to_address>
### Comment 16
<location path="package-lock.json" line_range="10784-10791" />
<code_context>
</code_context>
<issue_to_address>
**security (license/minipass-flush):** BlueOak-1.0.0: Open-source license could not be identified
The obligations of the `BlueOak-1.0.0` license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
*Source: trivy*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| "version": "6.2.2", | ||
| "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz", | ||
| "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==", | ||
| "dev": true, | ||
| "license": "MIT", | ||
| "engines": { | ||
| "node": ">=12" |
There was a problem hiding this comment.
security (CVE-2021-3807): nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Source: trivy
| "node_modules/@npmcli/arborist/node_modules/minimatch": { | ||
| "version": "9.0.9", | ||
| "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", | ||
| "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", | ||
| "license": "ISC", | ||
| "dependencies": { | ||
| "fs-extra": "^9.1.0", | ||
| "ssri": "^9.0.1", | ||
| "tar": "^6.1.0" | ||
| "brace-expansion": "^2.0.2" | ||
| }, | ||
| "engines": { | ||
| "node": "^14.15.0 || >=16.0.0" | ||
| "node": ">=16 || 14 >=14.17" | ||
| }, | ||
| "funding": { | ||
| "url": "https://github.com/sponsors/isaacs" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-26996): minimatch: Denial of Service via specially crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
Source: trivy
| "node_modules/@npmcli/arborist/node_modules/minimatch": { | ||
| "version": "9.0.9", | ||
| "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", | ||
| "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", | ||
| "license": "ISC", | ||
| "dependencies": { | ||
| "fs-extra": "^9.1.0", | ||
| "ssri": "^9.0.1", | ||
| "tar": "^6.1.0" | ||
| "brace-expansion": "^2.0.2" | ||
| }, | ||
| "engines": { | ||
| "node": "^14.15.0 || >=16.0.0" | ||
| "node": ">=16 || 14 >=14.17" | ||
| }, | ||
| "funding": { | ||
| "url": "https://github.com/sponsors/isaacs" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-27903): minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne() performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent ** (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where n is the number of path segments and k is the number of globstars. With k=11 and n=30, a call to the default minimatch() API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to minimatch() is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
Source: trivy
| "node_modules/@npmcli/arborist/node_modules/minimatch": { | ||
| "version": "9.0.9", | ||
| "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", | ||
| "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", | ||
| "license": "ISC", | ||
| "dependencies": { | ||
| "fs-extra": "^9.1.0", | ||
| "ssri": "^9.0.1", | ||
| "tar": "^6.1.0" | ||
| "brace-expansion": "^2.0.2" | ||
| }, | ||
| "engines": { | ||
| "node": "^14.15.0 || >=16.0.0" | ||
| "node": ">=16 || 14 >=14.17" | ||
| }, | ||
| "funding": { | ||
| "url": "https://github.com/sponsors/isaacs" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-27904): Minimatch: Denial of Service via catastrophic backtracking in glob expressions
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Source: trivy
| "node_modules/@npmcli/arborist/node_modules/minimatch": { | ||
| "version": "9.0.9", | ||
| "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", | ||
| "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", | ||
| "license": "ISC", | ||
| "dependencies": { | ||
| "fs-extra": "^9.1.0", | ||
| "ssri": "^9.0.1", | ||
| "tar": "^6.1.0" | ||
| "brace-expansion": "^2.0.2" | ||
| }, | ||
| "engines": { | ||
| "node": "^14.15.0 || >=16.0.0" | ||
| "node": ">=16 || 14 >=14.17" | ||
| }, | ||
| "funding": { | ||
| "url": "https://github.com/sponsors/isaacs" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-26996): minimatch: Denial of Service via specially crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
Source: trivy
| "node_modules/@npmcli/arborist/node_modules/minimatch": { | ||
| "version": "9.0.9", | ||
| "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", | ||
| "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", | ||
| "license": "ISC", | ||
| "dependencies": { | ||
| "fs-extra": "^9.1.0", | ||
| "ssri": "^9.0.1", | ||
| "tar": "^6.1.0" | ||
| "brace-expansion": "^2.0.2" | ||
| }, | ||
| "engines": { | ||
| "node": "^14.15.0 || >=16.0.0" | ||
| "node": ">=16 || 14 >=14.17" | ||
| }, | ||
| "funding": { | ||
| "url": "https://github.com/sponsors/isaacs" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-27903): minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne() performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent ** (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where n is the number of path segments and k is the number of globstars. With k=11 and n=30, a call to the default minimatch() API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to minimatch() is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
Source: trivy
| "node_modules/@npmcli/arborist/node_modules/minimatch": { | ||
| "version": "9.0.9", | ||
| "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", | ||
| "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", | ||
| "license": "ISC", | ||
| "dependencies": { | ||
| "fs-extra": "^9.1.0", | ||
| "ssri": "^9.0.1", | ||
| "tar": "^6.1.0" | ||
| "brace-expansion": "^2.0.2" | ||
| }, | ||
| "engines": { | ||
| "node": "^14.15.0 || >=16.0.0" | ||
| "node": ">=16 || 14 >=14.17" | ||
| }, | ||
| "funding": { | ||
| "url": "https://github.com/sponsors/isaacs" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-27904): Minimatch: Denial of Service via catastrophic backtracking in glob expressions
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Source: trivy
| "node_modules/sigstore": { | ||
| "version": "2.3.1", | ||
| "resolved": "https://registry.npmjs.org/sigstore/-/sigstore-2.3.1.tgz", | ||
| "integrity": "sha512-8G+/XDU8wNsJOQS5ysDVO0Etg9/2uA5gR9l4ZwijjlwxBcrU6RPfwi2+jJmbP+Ap1Hlp/nVAaEO4Fj22/SL2gQ==", | ||
| "license": "Apache-2.0", | ||
| "dependencies": { | ||
| "@sigstore/bundle": "^2.3.2", | ||
| "@sigstore/core": "^1.0.0", | ||
| "@sigstore/protobuf-specs": "^0.3.2", | ||
| "@sigstore/sign": "^2.3.2", | ||
| "@sigstore/tuf": "^2.3.4", | ||
| "@sigstore/verify": "^1.2.1" | ||
| }, | ||
| "engines": { | ||
| "node": "^16.14.0 || >=18.0.0" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-48815): sigstore's certificateOIDs verification constraints are silently dropped and never enforced
Summary
The documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked.
Details
The public verify options include certificateOIDs and the documentation says those OID/value pairs “must be present in the certificate’s extension list.” The policy-construction path used by sigstore.verify() and createVerifier() only copies the SAN and issuer settings into the verification policy and completely ignores certificateOIDs.
As a result, callers can believe they are constraining verification to certificates carrying specific Fulcio or workload-identifying OIDs, while the actual verifier never receives those constraints. Any bundle that satisfies the remaining checks is accepted even if the required OID extensions are absent or mismatched.
This is reachable from supported usage through the documented certificateOIDs verify option.
PoC
const { createVerificationPolicy } = require("sigstore/dist/config");
const policy = createVerificationPolicy({
certificateIssuer: "https://issuer.example",
certificateIdentityEmail: "victim@example.com",
certificateOIDs: {
"1.2.3.4": "required-value",
},
});
console.log("certificateOIDs" in policy, JSON.stringify(policy));
// false {"subjectAlternativeName":"victim@example.com","extensions":{"issuer":"https://issuer.example"}}Impact
Applications that rely on certificateOIDs to restrict which certificates may sign artifacts receive no such protection. Unauthorized certificates that should be rejected on extension policy can be accepted as long as they satisfy the remaining verification checks.
Source: trivy
| "node_modules/@npmcli/git/node_modules/isexe": { | ||
| "version": "3.1.5", | ||
| "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz", | ||
| "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==", | ||
| "license": "BlueOak-1.0.0", | ||
| "engines": { | ||
| "node": "^14.15.0 || >=16.0.0" | ||
| "node": ">=18" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/isexe): BlueOak-1.0.0: Open-source license could not be identified
The obligations of the BlueOak-1.0.0 license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
Source: trivy
| "node_modules/minipass-flush": { | ||
| "version": "1.0.5", | ||
| "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz", | ||
| "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==", | ||
| "license": "ISC", | ||
| "version": "1.0.7", | ||
| "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.7.tgz", | ||
| "integrity": "sha512-TbqTz9cUwWyHS2Dy89P3ocAGUGxKjjLuR9z8w4WUTGAVgEj17/4nhgo2Du56i0Fm3Pm30g4iA8Lcqctc76jCzA==", | ||
| "license": "BlueOak-1.0.0", | ||
| "dependencies": { | ||
| "minipass": "^3.0.0" | ||
| }, |
There was a problem hiding this comment.
security (license/minipass-flush): BlueOak-1.0.0: Open-source license could not be identified
The obligations of the BlueOak-1.0.0 license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
Source: trivy
2 participants
Snyk has created this PR to fix 5 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonpackage-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-JSYAML-17900054
SNYK-JS-TAR-17909068
SNYK-JS-TAR-17909104
SNYK-JS-TAR-17909152
SNYK-JS-TAR-17909225
Breaking Change Risk
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Allocation of Resources Without Limits or Throttling
🦉 Uncaught Exception