Vulnerability · Published Feb 20, 2026 · Assigned by GitHub_M
CVE-2026-26996minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
High 8.7
In plain English
A high-severity regular-expression denial of service in minimatch from isaacs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.6%top 52.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:8 | nodejs | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | nodejs | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 | ALSA-2026:7670 |
| AlmaLinux:9 | nodejs | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux:9 | nodejs | 1:20.20.2-1.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:8 | nodejs-devel | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 | ALSA-2026:7670 |
| AlmaLinux:8 | nodejs-devel | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:8 | nodejs-devel | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:9 | nodejs-devel | 1:20.20.2-1.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:9 | nodejs-devel | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux:9 | nodejs-devel | 1:20.20.2-1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux:10 | nodejs-docs | 1:22.22.2-1.el10_1 | ALSA-2026:7080 |
| AlmaLinux:8 | nodejs-docs | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 | ALSA-2026:7670 |
| AlmaLinux:8 | nodejs-docs | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | nodejs-docs | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:9 | nodejs-docs | 1:20.20.2-1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux:9 | nodejs-docs | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux:8 | nodejs-full-i18n | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | nodejs-full-i18n | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 | ALSA-2026:7670 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.20.2-1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux:9 | nodejs-full-i18n | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.20.2-1.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:8 | nodejs-libs | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | nodejs-libs | 1:24.14.1-2.module_el8.10.0+4160+4819ac42 | ALSA-2026:7670 |
| AlmaLinux:9 | nodejs-libs | 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3982+85c136aa | ALSA-2026:8339 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.3-1.module_el8.10.0+4061+f8ceeab9 | ALSA-2026:7670 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+4006+3c416519 | ALSA-2026:7123 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.3-3.module_el9.7.0+209+ecf6523e | ALSA-2026:7350 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.5.0+125+8dc38870 | ALSA-2026:7896 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:7670 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:7350 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:7670 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+198+8bf605ba | ALSA-2026:7350 |
| AlmaLinux:10 | nodejs24-docs | 1:24.14.1-2.el10_1 | ALSA-2026:7675 |
| AlmaLinux:10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.el10_1 | ALSA-2026:7675 |
| AlmaLinux:8 | npm | 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:8 | npm | 1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | npm | 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42 | ALSA-2026:7670 |
| AlmaLinux:9 | npm | 1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:9 | npm | 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| AlmaLinux:9 | npm | 1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux:8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42 | ALSA-2026:7670 |
| AlmaLinux:9 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 | ALSA-2026:7350 |
| Debian:12 | node-minimatch | no fix listed | DEBIAN-CVE-2026-26996 |
| Debian:13 | node-minimatch | no fix listed | DEBIAN-CVE-2026-26996 |
| Debian:14 | node-minimatch | 9.0.7-1 | DEBIAN-CVE-2026-26996 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1667+4a788d89 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1823+b5789597 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1924+614dc87f | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1666+930e28e8 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1667+4a788d89 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1666+930e28e8 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.3-1.module+el8.10.0+2084+ab509703 | RLSA-2026:7670 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1823+b5789597 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1924+614dc87f | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:8339 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:7896 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:7302 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:7302 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:7302 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2 | RLSA-2026:7350 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:7896 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:7896 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:7670 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:7896 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:7350 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:7302 |
| Rocky Linux:10 | nodejs22 | 1:22.22.2-1.el10_1 | RLSA-2026:7080 |
| Rocky Linux:10 | nodejs24 | 1:24.14.1-2.el10_1 | RLSA-2026:7675 |
| Ubuntu:22.04:LTS | node-minimatch | no fix listed | UBUNTU-CVE-2026-26996 |
| Ubuntu:24.04:LTS | node-minimatch | no fix listed | UBUNTU-CVE-2026-26996 |
| Ubuntu:25.10 | node-minimatch | no fix listed | UBUNTU-CVE-2026-26996 |
| Ubuntu:26.04:LTS | node-minimatch | no fix listed | UBUNTU-CVE-2026-26996 |
| Ubuntu:26.10 | node-minimatch | no fix listed | UBUNTU-CVE-2026-26996 |
| npm | minimatch | 4.2.4 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | 5.1.7 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | 6.2.1 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | 7.4.7 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | 8.0.5 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | 9.0.6 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | 3.1.3 | GHSA-3ppc-4f35-3m26 |
| npm | minimatch | 10.2.1 | GHSA-3ppc-4f35-3m26 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N