Skip to content

[Aikido] Fix 5 security issues in yaml, minimatch, ajv#1633

Open
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-20837274-m9em
Open

[Aikido] Fix 5 security issues in yaml, minimatch, ajv#1633
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-20837274-m9em

Conversation

@aikido-autofix
Copy link
Contributor

Upgrade yaml, minimatch, and ajv to fix DoS vulnerabilities: yaml stack overflow from deeply nested structures, minimatch ReDoS from glob patterns with consecutive wildcards and globstars, and ajv ReDoS from unvalidated regex patterns.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-33532
MEDIUM
[yaml] A stack overflow vulnerability in the compose/resolve phase allows attackers to trigger a RangeError via deeply nested YAML structures (~2–10 KB), potentially causing denial of service or process termination in applications that don't catch this unexpected exception type.
CVE-2026-26996
LOW
[minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs.
CVE-2026-27903
LOW
[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems.
CVE-2026-27904
LOW
[minimatch] Nested extglobs (*() and +()) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.
CVE-2025-69873
LOW
[ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort.

@aikido-autofix aikido-autofix bot requested a review from a team as a code owner March 26, 2026 23:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants