node-glob CVE-2026-118773

Exploitation requires BOTH of the following in the consuming application: (1) it calls glob() or globStream() with the 'signal' option using AbortSignal or AbortSignal.timeout() AND relies on that cancellation as a traversal cost/budget bound; and (2) it exposes attacker-influenced glob patterns or attacker-controlled directory trees to that call. The concrete trigger is confirmed by source: the abort branches in src/walker.ts execute 'cb()' without 'return', so after the signal aborts, execution still reaches processor.processPatterns(), readdirCB(), and recursive walkCB2(), continuing filesystem traversal after rejection. Limiting factors that reduce real-world risk: impact is availability-only (no confidentiality/integrity), it is partial (VA:L), and it has NO effect on applications that do not use signal/timeout as a cost budget. No authentication is required (PR:N per the provided vector). The only complete fix per the vendor is upgrading to glob 14.0.2.

This is a CWE-400 resource-exhaustion (availability-only) issue in node-glob, rated by the vendor at CVSS 4.0 6.3 (medium) with vector AV:N/AC:L/AT:P/PR:N/UI:N and only partial availability impact (VA:L); confidentiality and integrity are explicitly unaffected (VC:N/VI:N). The signals are internally consistent but modest: PR:N means no authentication is required, but AT:P (attack requirement present) reflects that exploitation is conditional on a specific application design - the app must use glob()/globStream() with AbortSignal or AbortSignal.timeout() as a traversal budget AND expose attacker-influenced patterns or directory trees. No CISA KEV entry is present, so this is NOT confirmed actively exploited. No EPSS score was provided, so exploitation probability cannot be quantified from the input. A public PoC reference exists in the GHSA advisory (reproduction steps plus measured output showing ~1360 extra readdir calls after a request was already rejected); it is not verified here as distributable working exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-urgent, bounded-impact defect. Bottom line: this is a genuine but conditional availability issue rather than a high-severity emergency - for the common case where consumers do not rely on cancellation as a cost budget over attacker-controlled input, real-world risk is low; for services that do rely on that budget, it meaningfully undermines a DoS control they believe they have.

A service exposes file/path searching that passes user-supplied glob patterns into glob() or globStream() and bounds each request with AbortSignal.timeout() to cap traversal cost. An attacker repeatedly submits broad patterns (e.g. '**') against deep or large directory trees; although each request times out and the promise rejects, the walker keeps issuing readdir calls and recursing in the background, so stacked timed-out requests accumulate filesystem I/O and CPU and degrade worker throughput. The GHSA advisory documents a PoC demonstrating that ~1360 directory reads continued after the operation had already been aborted.