https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27904.htmlhttps://patchthecve.com/cve/CVE-2026-27904.htmlWed, 17 Jun 2026 10:27:51 +0000HIGH 7.5: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrohttps://patchthecve.com/cve/CVE-2026-27903.htmlhttps://patchthecve.com/cve/CVE-2026-27903.htmlWed, 17 Jun 2026 10:27:51 +0000HIGH 7.5: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSThttps://patchthecve.com/cve/CVE-2026-26996.htmlhttps://patchthecve.com/cve/CVE-2026-26996.htmlWed, 17 Jun 2026 10:26:30 +0000HIGH 7.5: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appe