Skip to main content

Minimatch CVE-2026-26996

HIGH
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-02-20 security-advisories@github.com GHSA-3ppc-4f35-3m26
Denial Of Service Red Hat Minimatch Suse Minimatch Project
7.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 12, 2026 - 22:04 vuln.today
PoC Detected
Mar 06, 2026 - 21:32 vuln.today
Public exploit code
Patch released
Mar 06, 2026 - 21:32 nvd
Patch available
CVE Published
Feb 20, 2026 - 03:16 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 4 npm packages depend on minimatch (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.0.0.

DescriptionGitHub Advisory

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

AnalysisAI

Minimatch versions 10.2.0 and below suffer from catastrophic backtracking in regular expression processing when glob patterns contain multiple consecutive wildcards, enabling denial of service attacks with exponential time complexity. Applications that process user-supplied glob patterns are vulnerable to CPU exhaustion, with worst-case scenarios causing indefinite hangs; public exploit code exists for this vulnerability. The issue is resolved in version 10.2.1.

Technical ContextAI

Classified as CWE-1333 (Inefficient Regular Expression Complexity (ReDoS)). Affects Minimatch. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N)

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 10.2.1.. Restrict network access to the affected service where possible.

More in Minimatch

View all
CVE-2026-27903 HIGH POC
7.5 Feb 26

Minimatch versions before 3.1.3 through 10.2.3 suffer from catastrophic backtracking in glob pattern matching when proce
CVE-2026-27904 HIGH POC
7.5 Feb 26

Minimatch versions prior to 10.2.3 (and earlier affected versions) suffer from ReDoS vulnerabilities in nested extglob p
CVE-2022-3517 HIGH
7.5 Oct 17

A vulnerability was found in the minimatch package. Rated high severity (CVSS 7.5), this vulnerability is remotely explo

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-48801 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7
CVE-2024-21490 HIGH POC
7.5
CVE-2022-42969 HIGH POC
7.5
CVE-2015-8315 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container rancher/elemental-channel/sl-micro:6.0-baremetal Container rancher/elemental-channel/sl-micro:6.0-base Container rancher/elemental-channel/sl-micro:6.0-kvm Container rancher/elemental-channel/sl-micro:6.0-rt Container suse/sl-micro/6.0/baremetal-iso-image:latest Container suse/sl-micro/6.0/base-iso-image:latest Container suse/sl-micro/6.0/kvm-iso-image:latest Container suse/sl-micro/6.0/rt-iso-image:latest Container suse/sl-micro/6.1/baremetal-iso-image:latest Container suse/sl-micro/6.1/base-iso-image:latest Container suse/sl-micro/6.1/kvm-iso-image:latest Container suse/sl-micro/6.1/rt-iso-image:latest Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.88 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-EC2 Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Container suse/sl-micro/6.1/base-os-container:latest Container suse/sl-micro/6.1/kvm-os-container:latest Container suse/sl-micro/6.1/rt-os-container:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro-BYOS-GCE Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
SUSE Liberty Linux 8 Fixed

Share

CVE-2026-26996 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy