Change Request: CVE in minimatch / brace-expansion

Author: jendrikwCreated Jul 29, 2026Updated Sep 16, 2026

Labelsenhancementcoreaccepted

ESLint version

v9.39.5

What problem do you want to solve?

eslint depends on a vulnerable version of minimatch / brace-expansion: https://github.com/advisories/GHSA-mh99-v99m-4gvg:

# npm audit report

brace-expansion  <=5.0.7
Severity: high
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/@eslint/config-array/node_modules/brace-expansion
node_modules/@eslint/eslintrc/node_modules/brace-expansion
node_modules/eslint-config-preact/node_modules/brace-expansion
node_modules/eslint/node_modules/brace-expansion
  minimatch  2.0.0 - 10.0.2
  Depends on vulnerable versions of brace-expansion
  node_modules/@eslint/config-array/node_modules/minimatch
  node_modules/@eslint/eslintrc/node_modules/minimatch
  node_modules/eslint-config-preact/node_modules/minimatch
  node_modules/eslint/node_modules/minimatch
    @eslint/config-array  <=0.22.0
    Depends on vulnerable versions of minimatch
    node_modules/@eslint/config-array
      eslint  0.12.0 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2
      Depends on vulnerable versions of @eslint/config-array
      Depends on vulnerable versions of @eslint/eslintrc
      Depends on vulnerable versions of minimatch
      node_modules/eslint
        @babel/eslint-parser  7.16.0 - 8.0.0-rc.6
        Depends on vulnerable versions of eslint
        node_modules/eslint-config-preact/node_modules/@babel/eslint-parser
          eslint-config-preact  *
          Depends on vulnerable versions of @babel/eslint-parser
          Depends on vulnerable versions of eslint
          Depends on vulnerable versions of eslint-plugin-react
          node_modules/eslint-config-preact
    @eslint/eslintrc  0.0.1 || >=0.1.1
    Depends on vulnerable versions of minimatch
    node_modules/@eslint/eslintrc

npm why brace-expansion:

[email protected] dev
node_modules/@eslint/config-array/node_modules/brace-expansion
  brace-expansion@"^1.1.7" from [email protected]
  node_modules/@eslint/config-array/node_modules/minimatch
    minimatch@"^3.1.5" from @eslint/[email protected]
    node_modules/@eslint/config-array
      @eslint/config-array@"^0.21.2" from [email protected]
      node_modules/eslint
        dev eslint@"^9.39.5" from the root project
        ...
        
[email protected] dev
node_modules/@eslint/eslintrc/node_modules/brace-expansion
  brace-expansion@"^1.1.7" from [email protected]
  node_modules/@eslint/eslintrc/node_modules/minimatch
    minimatch@"^3.1.5" from @eslint/[email protected]
    node_modules/@eslint/eslintrc
      @eslint/eslintrc@"^3.3.6" from [email protected]
      node_modules/eslint
        dev eslint@"^9.39.5" from the root project
        ...

[email protected] dev
node_modules/eslint/node_modules/brace-expansion
  brace-expansion@"^1.1.7" from [email protected]
  node_modules/eslint/node_modules/minimatch
    minimatch@"^3.1.5" from [email protected]
    node_modules/eslint
      dev eslint@"^9.39.5" from the root project
      ...

What do you think is the correct solution?

Update the version of minimatch used by @eslint/config-array, @eslint/eslintrc, and eslint.

Participation

I am willing to submit a pull request for this change.

AI acknowledgment

I did not use AI to generate this issue report.
(If the above is not checked) I have reviewed the AI-generated content before submitting.

Additional comments

No response

Source: eslint/eslint

View original on GitHub View discussion on GitHub