CVE-2026-26996: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-20 · updated 2026-06-17
Weakness: CWE-1333

Description

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Affected products

isaacs minimatch: from 3.0.0 before 3.1.3; from 4.0.0 before 4.2.4; from 5.0.0 before 5.1.7; from 6.0.0 before 6.2.1; from 7.0.0 before 7.4.7; from 8.0.0 before 8.0.5 — fixed in 10.2.1, 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7
Npm Minimatch: from 10.0.0 before 10.2.1; from 9.0.0 before 9.0.6; from 8.0.0 before 8.0.5; from 7.0.0 before 7.4.7; from 6.0.0 before 6.2.1; from 5.0.0 before 5.1.7 — fixed in 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7

How to fix

Upgrade to a fixed version: isaacs minimatch 10.2.1, 3.1.3, 4.2.4, 5.1.7; Npm Minimatch 10.2.1, 9.0.6, 8.0.5, 7.4.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-26996 or the next vulnerability affects your stack