Skip to content

[Aikido] Fix 2 security issues in ajv, minimatch#1615

Closed
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-16957330-qqTe
Closed

[Aikido] Fix 2 security issues in ajv, minimatch#1615
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-16957330-qqTe

Conversation

@aikido-autofix
Copy link
Contributor

Upgrade ajv and minimatch to mitigate ReDoS vulnerabilities that can cause catastrophic regex backtracking and potential denial of service attacks.

✅ Code not affected by breaking changes.

No breaking changes from the minimatch upgrade (3.1.2 => 10.2.1) affect this codebase.

While minimatch is present as a transitive dependency through ESLint and other tools (visible in yarn.lock), and is explicitly set in the resolutions section of package.json to version 10.2.1, the codebase does not directly import or use minimatch. The only indirect usage is through ESLint's ignorePatterns in .eslintrc.json, which uses simple glob patterns (**/node_modules/**, **/dist/**, etc.) that are fully compatible with all versions of minimatch and are not affected by any of the breaking changes (forward slash requirement, .. preprocessing, default export removal, or Node.js version requirements).

All breaking changes by upgrading minimatch from version 3.1.2 to 10.2.1 (CHANGELOG)

Version Description
5.0.0
Expect exclusively forward slash as path sep, same as node-glob
7.0.0
Preprocess patterns to simplify complicated patterns and reduce out .. pattern portions where possible. Note that this means a pattern like a/b/../* will be equivalent to a/*, and will not match the string a/b/../c
8.0.0
Bump required Node.js version
9.0.0
No default export, only named exports
10.0.0
Require node 20 or 22 and higher
✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2025-69873
LOW
[ajv] A ReDoS vulnerability in the pattern keyword allows attackers to inject malicious regex patterns via $data references, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling denial of service attacks against APIs using dynamic schema validation.
CVE-2026-26996
LOW
[ajv] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch are vulnerable to severe performance degradation or hangs.

@aikido-autofix aikido-autofix bot requested a review from a team as a code owner February 21, 2026 23:36
@aikido-autofix aikido-autofix bot closed this Feb 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants