Skip to main content

Minimatch CVE-2026-26996

HIGH
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-02-20 security-advisories@github.com GHSA-3ppc-4f35-3m26
Denial Of Service Red Hat Minimatch Suse Minimatch Project
7.5
CVSS 3.1 · GitHub Advisory
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft glob pattern with many consecutive * wildcards
  2. Exploit
    Pass pattern to minimatch()
  3. Execution
    Trigger exponential regex backtracking
  4. Impact
    Exhaust CPU resources causing denial of service

Vulnerability Assessment

Weakness
CWE
CWE-1333
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

No special conditions — remote unauthenticated exploitation against minimatch versions 10.2.0 and below when processing user-supplied glob patterns with consecutive wildcards followed by non-matching literal characters.
Impact

CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Public exploit/POC available.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Minimatch versions 10.2.0 and below suffer from catastrophic backtracking in regular expression processing when glob patterns contain multiple consecutive wildcards, enabling denial of service attacks with exponential time complexity. Applications that process user-supplied glob patterns are vulnerable to CPU exhaustion, with worst-case scenarios causing indefinite hangs; public exploit code exists for this vulnerability. The issue is resolved in version 10.2.1.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 22:04 CVSS 7.5

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. [CVSS 7.5 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 10.2.1.. Restrict network access to the affected service where possible.

Affected Packages

npm minimatch fix: 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7, 8.0.5, 9.0.6, 10.2.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-1333 (Inefficient Regular Expression Complexity (ReDoS)). Affects Minimatch. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N)

Know when Minimatch gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 6.5 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
PoC Detected
Mar 06, 2026 - 21:32 vuln.today
Public exploit code
Patch released
Mar 06, 2026 - 21:32 nvd
Patch available
CVE Published
Feb 20, 2026 - 03:16 nvd
HIGH 7.5

DescriptionGitHub Advisory

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 4 npm packages depend on minimatch (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.0.0.

Executive ViewAI

Why It Matters

A HIGH severity vulnerability (CVE-2026-26996) has been identified in the minimatch library, a widely-used JavaScript utility for glob pattern matching. Organizations using applications or dependencies that include minimatch are at risk of exploitation, as public exploits are already available. Immediate patching is required to prevent potential code execution or denial of service incidents.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 84% exploitable
Exploit
POC
Public exploit code exists
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*

More in Minimatch

View all
CVE-2026-27903 HIGH POC
7.5 Feb 26

Minimatch versions before 3.1.3 through 10.2.3 suffer from catastrophic backtracking in glob pattern matching when proce
CVE-2026-27904 HIGH POC
7.5 Feb 26

Minimatch versions prior to 10.2.3 (and earlier affected versions) suffer from ReDoS vulnerabilities in nested extglob p
CVE-2022-3517 HIGH
7.5 Oct 17

A vulnerability was found in the minimatch package. Rated high severity (CVSS 7.5), this vulnerability is remotely explo

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-116693 HIGH POC
8.7
CVE-2026-48801 HIGH POC
8.7
CVE-2026-57584 HIGH POC
8.7
CVE-2026-118686 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container rancher/elemental-channel/sl-micro:6.0-baremetal Container rancher/elemental-channel/sl-micro:6.0-base Container rancher/elemental-channel/sl-micro:6.0-kvm Container rancher/elemental-channel/sl-micro:6.0-rt Container suse/sl-micro/6.0/baremetal-iso-image:latest Container suse/sl-micro/6.0/base-iso-image:latest Container suse/sl-micro/6.0/kvm-iso-image:latest Container suse/sl-micro/6.0/rt-iso-image:latest Container suse/sl-micro/6.1/baremetal-iso-image:latest Container suse/sl-micro/6.1/base-iso-image:latest Container suse/sl-micro/6.1/kvm-iso-image:latest Container suse/sl-micro/6.1/rt-iso-image:latest Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.88 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-EC2 Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Container suse/sl-micro/6.1/base-os-container:latest Container suse/sl-micro/6.1/kvm-os-container:latest Container suse/sl-micro/6.1/rt-os-container:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro-BYOS-GCE Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
SUSE Liberty Linux 8 Fixed

References

Advisories & patches
PATCH https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5 ADVISORY https://access.redhat.com/errata/RHSA-2026:4942 ADVISORY https://access.redhat.com/errata/RHSA-2026:5168 ADVISORY https://access.redhat.com/errata/RHSA-2026:5665 ADVISORY https://access.redhat.com/errata/RHSA-2026:6192 ADVISORY https://access.redhat.com/errata/RHSA-2026:6497 ADVISORY https://access.redhat.com/errata/RHSA-2026:6567 ADVISORY https://access.redhat.com/errata/RHSA-2026:6568 ADVISORY https://access.redhat.com/errata/RHSA-2026:7080 ADVISORY https://access.redhat.com/errata/RHSA-2026:7123 ADVISORY https://access.redhat.com/errata/RHSA-2026:7302 ADVISORY https://access.redhat.com/errata/RHSA-2026:7310 ADVISORY https://access.redhat.com/errata/RHSA-2026:7350 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1232/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20950/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20967/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20973/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20997/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy