Skip to main content

Minimatch CVE-2026-27904

HIGH
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-02-26 security-advisories@github.com GHSA-23c5-xmqv-rm74
Denial Of Service Red Hat Minimatch Suse Minimatch Project
7.5
CVSS 3.1 · GitHub Advisory
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft nested extglob pattern with multiple *()
  2. Exploit
    Pass pattern to minimatch() function
  3. Execution
    Trigger catastrophic backtracking in regex engine
  4. Impact
    Cause denial of service via CPU exhaustion

Vulnerability Assessment

Weakness
CWE
CWE-1333
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

No special conditions — remote unauthenticated exploitation against default minimatch() API versions prior to 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, and 10.2.3. Vulnerable to nested extglob patterns like *(*(*(a|b))) without special configuration.
Impact

CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Public exploit/POC available.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Minimatch versions prior to 10.2.3 (and earlier affected versions) suffer from ReDoS vulnerabilities in nested extglob patterns that generate regexps with catastrophic backtracking, allowing remote attackers to cause denial of service with minimal input. A 12-byte glob pattern like *(*(*(a|b))) combined with an 18-byte non-matching string can hang the application for 7+ seconds, with larger patterns stalling for minutes. Public exploit code exists and no patch is currently available, making this a critical risk for any application using the default minimatch API.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:55 CVSS 7.5

Minimatch versions up to 10.2.3 is affected by inefficient regular expression complexity (redos) (CVSS 7.5).

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affected Packages

npm minimatch fix: 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability (CWE-1333: Inefficient Regular Expression Complexity (ReDoS)) affects Minimatch. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe

Know when Minimatch gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 6.5 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
PoC Detected
Feb 27, 2026 - 17:16 vuln.today
Public exploit code
CVE Published
Feb 26, 2026 - 02:16 nvd
HIGH 7.5

DescriptionGitHub Advisory

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 4 npm packages depend on minimatch (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.0.0.

Executive ViewAI

Why It Matters

A critical denial-of-service vulnerability in the widely-used minimatch library (CVE-2026-27904) allows attackers to crash or hang applications through specially crafted glob patterns, affecting any organization using affected versions in Node.js environments. With public exploits available and no patch currently available, immediate mitigation is required to prevent service disruption.

Business Impact: High
Compensating Controls

Implement strict input validation and length limits on glob pattern parameters (reject patterns exceeding 100 characters or deeply nested parentheses); deploy WAF rules to detect and block exploit payloads matching the pattern *(*(*( signatures; apply rate limiting to glob pattern processing endpoints; consider disabling glob matching features if not business-critical; use process isolation/containerization to limit DoS blast radius; implement application-level timeouts (2-3 seconds max) for pattern matching operations.

Threat Intelligence Overview

EPSS Score
0.1%
Top 84% exploitable
Exploit
POC
Public exploit code exists
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*

More in Minimatch

View all
CVE-2026-27903 HIGH POC
7.5 Feb 26

Minimatch versions before 3.1.3 through 10.2.3 suffer from catastrophic backtracking in glob pattern matching when proce
CVE-2026-26996 HIGH POC
7.5 Feb 20

Minimatch versions 10.2.0 and below suffer from catastrophic backtracking in regular expression processing when glob pat
CVE-2022-3517 HIGH
7.5 Oct 17

A vulnerability was found in the minimatch package. Rated high severity (CVSS 7.5), this vulnerability is remotely explo

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-116693 HIGH POC
8.7
CVE-2026-48801 HIGH POC
8.7
CVE-2026-57584 HIGH POC
8.7
CVE-2026-118686 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:4942 ADVISORY https://access.redhat.com/errata/RHSA-2026:5168 ADVISORY https://access.redhat.com/errata/RHSA-2026:5665 ADVISORY https://access.redhat.com/errata/RHSA-2026:6277 ADVISORY https://access.redhat.com/errata/RHSA-2026:6497 ADVISORY https://access.redhat.com/errata/RHSA-2026:6567 ADVISORY https://access.redhat.com/errata/RHSA-2026:6568 ADVISORY https://access.redhat.com/errata/RHSA-2026:7080 ADVISORY https://access.redhat.com/errata/RHSA-2026:7123 ADVISORY https://access.redhat.com/errata/RHSA-2026:7302 ADVISORY https://access.redhat.com/errata/RHSA-2026:7310 ADVISORY https://vuldb.com/vuln/347951

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy