Repository navigation
[BUG] vulnerable glob dependency #8741
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
Running npm audit or a trivy scanner flags a high CVE-2025-64756 vulnerability due to glob@11.0.3. glob@11.1.0 fixes the issue. The problem is that this breaks application builds that make use of tools such as trivy scanner.
Notice that the CVE itself doesn't affect npm, as the issue is only in the cli interface of glob, while npm uses its library interface.
Expected Behavior
npm should not bundle a vulnerable version of glob and therefore not break builds due to security scans
Steps To Reproduce
- In this environment:
Node.js version: 20.17.0 (or higher)
npm version: 11.6.2
- Run 'npm audit'
- See error:
glob 10.3.7 - 11.0.3
Severity: high
glob CLI: Command injection via -c/--cmd executes matches with shell:true - https://github.com/advisories/GHSA-5j98-mcp5-4vw2
fix available via `npm audit fix`
node_modules/glob
Environment
- npm: 11.6.2
- Node.js: 20.17.0
- OS Name: macOS Sequoia 15.6.1
- System Model Name: MacBook Pro M3
- npm config:
; "user" config from /Users/root1/.npmrc
//registry.npmjs.org/:_authToken = (protected)
; "project" config from /Users/root1/code/npm/.npmrc
package-lock = true
; node bin location = /Users/root1/.nvm/versions/node/v20.17.0/bin/node
; node version = v20.17.0
; npm local prefix = /Users/root1/code/npm
; npm version = 11.6.2
; cwd = /Users/root1/code/npm
; HOME = /Users/root1
; Run `npm config ls -l` to show all defaults.Reacted by Nils Alex, arif-farwanto-evidence-care, Dmitriy Hulkovskyi, loïs, Owen Buckley, David Boclé, Miles Florence, therealentorres, zach-ball, Kelvin Guedes and 26 more
Activity
JeffreyStevens commentedon Nov 19, 2025
I'm also seeing issues with docker node:22-alpine image scans failing on these locations for glob (see node-gyp dependency):
/usr/local/lib/node_modules/npm/node_modules/node-gyp/node_modules/glob/package.json
/usr/local/lib/node_modules/npm/node_modules/glob/package.json
Related tar image also failing security scans:
/usr/local/lib/node_modules/npm/node_modules/tar/package.json
I opened related issue nodejs/node-gyp#3246
keptt commentedon Nov 20, 2025
npm 11.6.3 has just released but unfortunately this issue hasn't been addressed. Will have to wait for the next release. A temporary solution on the client-end seems to be creating a .trivyignore file with the CVE in-qeustion. Other security scanners should have a similar ignore-rule feature. This is, however, not ideal, as such practices may lead to false negatives
EDIT: to avoid false negatives, use .trivyignore.yml or a Rego file. They let you use more advanced filtering such as specifying a path to the vulnerable package. However, these features are experimental according to the Trivy docs
owlstronaut commentedon Nov 21, 2025
#8770 will be the dependency update for this
dtma007 commentedon Nov 21, 2025
@owlstronaut Thanks for the quick response! Sorry, I'm not familiar with the release process. Is there a rough ETA on when a new npm release will be available with the updated
globversion? Thanks again!owlstronaut commentedon Nov 21, 2025
Hopefully next week before the holiday weekend. I'll be working with @wraithgar to try to get it out
Andrea-Filice commentedon Nov 22, 2025
tell me that a fix is coming soon, I've been freaking out for 3 days trying to figure out why the
npm auditcommand gives me 2 high vulnerabilities.keptt commentedon Nov 22, 2025
Thanks @owlstronaut, appreciate that! Looking forward to the 11.6.4 release
dtma007 commentedon Nov 24, 2025
@owlstronaut Thanks for all your help! I just saw that the PR was approved: #8770 Any updates on the release availability?
djeevan-intel commentedon Nov 25, 2025
Will the PR fix for npm cli v10?
owlstronaut commentedon Nov 25, 2025
Either today or tomorrow, I'll discuss with the team shortly
dtma007 commentedon Nov 25, 2025
@owlstronaut Thanks so much! That's awesome news. This will be a great help for us, especially if the release were made available today. We appreciate the efforts to get this fix out so quickly.
BCsabaEngine commentedon Dec 12, 2025
Without new npm release we need to solve it: https://medium.com/@balazs.csaba.diy/whats-this-glob-npm-madness-suddenly-every-node-js-image-is-vulnerable-but-why-1ba1b0cbad97
fix: Remove npm and copilot-cli to eliminate CVE-2025-64756 and CVE-2…
fix: Remove npm and copilot-cli to eliminate CVE-2025-64756 and CVE-2…
arjunkgit commentedon Jan 6, 2026
Could someone clarify:
shrvr commentedon Jan 13, 2026
@owlstronaut ^ Is it planned? Thanks.