The minimatch utility is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability that can lead to application hanging and service unavailability.

The vulnerability stems from inefficient regular expression complexity (CWE-1333) where consecutive wildcard characters in a glob pattern trigger exponential backtracking in the V8 engine. This flaw allows an unauthenticated attacker to supply a malicious pattern string to the minimatch function, resulting in total application resource exhaustion.

The exploitation of this vulnerability results in a Denial of Service (DoS), which can lead to significant system downtime and operational disruption. Given the CVSS score of 7.5, this high-severity flaw poses a direct threat to the availability of any application processing user-controlled input through the minimatch library.

Immediate Action: Update the minimatch package to version 10.2.1, 9.0.6, 8.0.5, or 7.4.7 depending on your current dependency branch.

Proactive Monitoring: Monitor application performance metrics, specifically CPU utilization spikes, which may indicate attempted ReDoS attacks against input-processing modules.

Compensating Controls: Implement input validation to sanitize or limit the length of strings passed to glob matching functions, and deploy a Web Application Firewall (WAF) to detect or block unusually long or complex character sequences.

Public Exploit Available: Unknown.

The risk posed by this ReDoS vulnerability is significant for any environment that allows external users to influence pattern strings used in glob matching. Organizations must prioritize updating the minimatch dependency across all affected applications to the specified patched versions to restore service stability and prevent potential resource exhaustion attacks.