Register | Log in

node-glob

glob functionality for Node.js

Choose email to subscribe with

general

source: node-glob (main)
version: 13.0.6+~cs0.4.15-2
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: David Paleino (DMD) – Jérémy Lal (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 7.1.6+~7.1.3-1
oldstable: 8.0.3+~cs8.4.15-1
stable: 8.1.0+~cs8.5.15-1
testing: 13.0.6+~cs0.4.15-2
unstable: 13.0.6+~cs0.4.15-2

versioned links

7.1.6+~7.1.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.0.3+~cs8.4.15-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.1.0+~cs8.5.15-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
13.0.6+~cs0.4.15-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

node-glob (1 bugs: 0, 1, 0, 0)

action needed

A new upstream version is available: 14.0.3+~cs0.4.15 high

A new upstream version 14.0.3+~cs0.4.15 is available, you should consider packaging it.

Created: 2026-10-29 Last update: 2026-11-03 04:32

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-118773: Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.

Created: 2026-10-30 Last update: 2026-10-30 07:49

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-118773: Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.

Created: 2026-10-30 Last update: 2026-10-30 07:49

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-118773: Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.

Created: 2026-10-30 Last update: 2026-10-30 07:49

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-118773: Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.

Created: 2026-10-30 Last update: 2026-10-30 07:49

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-06-21 Last update: 2026-06-21 09:31

news

[2026-06-26] node-glob 13.0.6+~cs0.4.15-2 MIGRATED to testing (Debian testing watch)
[2026-06-20] Accepted node-glob 13.0.6+~cs0.4.15-2 (source) into unstable (Xavier Guimard)
[2026-05-23] node-glob 10.3.6+~cs0.4.15-9 MIGRATED to testing (Debian testing watch)
[2026-05-01] Accepted node-glob 10.3.6+~cs0.4.15-9 (source) into unstable (Xavier Guimard)
[2026-04-26] Accepted node-glob 13.0.6+~cs0.4.15-1 (source) into experimental (Xavier Guimard)
[2025-12-18] node-glob 10.3.6+~cs0.4.15-8 MIGRATED to testing (Debian testing watch)
[2025-12-13] Accepted node-glob 10.3.6+~cs0.4.15-8 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-12-05] node-glob 10.3.6+~cs0.4.15-7 MIGRATED to testing (Debian testing watch)
[2025-12-02] Accepted node-glob 10.3.6+~cs0.4.15-7 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-12-01] node-glob 10.3.6+~cs0.4.15-5 MIGRATED to testing (Debian testing watch)
[2025-11-30] Accepted node-glob 10.3.6+~cs0.4.15-6 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-11-24] Accepted node-glob 10.3.6+~cs0.4.15-5 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-11-23] Accepted node-glob 10.3.6+~cs0.4.15-4 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-11-21] Accepted node-glob 10.3.6+~cs0.4.15-3 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-11-20] Accepted node-glob 10.3.6+~cs0.4.15-2 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-11-20] Accepted node-glob 10.2.7+~cs0.4.15-1 (source all) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-08-28] Accepted node-glob 10.3.6+~cs0.4.15-1 (source) into experimental (Jérémy Lal)
[2023-12-27] node-glob 8.1.0+~cs8.5.15-1 MIGRATED to testing (Debian testing watch)
[2023-12-22] Accepted node-glob 8.1.0+~cs8.5.15-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2023-10-17] node-glob 8.0.3+~cs8.4.15-4 MIGRATED to testing (Debian testing watch)
[2023-10-12] Accepted node-glob 8.0.3+~cs8.4.15-4 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2023-09-25] Accepted node-glob 8.0.3+~cs8.4.15-3 (source all) into unstable (Yadd) (signed by: Xavier Guimard)
[2023-09-22] Accepted node-glob 8.0.3+~cs8.4.15-2 (source all) into experimental (Yadd) (signed by: Xavier Guimard)
[2022-12-04] node-glob 8.0.3+~cs8.4.15-1 MIGRATED to testing (Debian testing watch)
[2022-11-29] Accepted node-glob 8.0.3+~cs8.4.15-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-05-23] node-glob 8.0.3+~cs7.6.15-1 MIGRATED to testing (Debian testing watch)
[2022-05-18] Accepted node-glob 8.0.3+~cs7.6.15-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-05-10] node-glob 8.0.1+~cs7.6.15-1 MIGRATED to testing (Debian testing watch)
[2022-05-05] Accepted node-glob 8.0.1+~cs7.6.15-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-04-02] node-glob 7.2.1+~cs7.6.15-2 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 13.0.6+~cs0.4.15-2

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing