CVE-2026-26996 high severity vulnerability in minimatch@3 used in @actions/glob & @actions/cache

[MikeMcC399]

Situation

npm audit reports a high severity vulnerability CVE-2026-26996 (GHSA-3ppc-4f35-3m26) in minimatch@3.1.2 using @actions/glob@0.6.1

minimatch@3.1.2 is a legacy version, released on Feb 15, 2022

The latest version is minimatch@10.2.1

Steps to reproduce

cd $(mktemp -d)
npm install @actions/cache @actions/glob
npm audit

Logs

$ npm audit
# npm audit report

minimatch  <10.2.1
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
No fix available
node_modules/minimatch
  @actions/glob  *
  Depends on vulnerable versions of minimatch
  node_modules/@actions/glob
    @actions/cache  *
    Depends on vulnerable versions of @actions/glob
    node_modules/@actions/cache

3 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

Suggestion

Update to minimatch@10.2.1 or above

[MikeMcC399]

This vulnerability affects also @actions/cache which has a direct dependency on @actions/glob

[MikeMcC399]

See PR #2306 for a suggested partial solution

[MikeMcC399]

Are there any maintainers available to comment?

[MikeMcC399]

Closing, as the repro steps no longer show a vulnerability. Instead minimatch@3.1.5 is installed, which now satisfies the requirements of GHSA-3ppc-4f35-3m26.