Vulnerability · Published Feb 26, 2026 · Assigned by GitHub_M
CVE-2026-27904minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
High 7.5
In plain English
A high-severity regular-expression denial of service in minimatch from isaacs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 55.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:8 | nodejs | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:9 | nodejs | 1:20.20.2-1.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:8 | nodejs-devel | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | nodejs-devel | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:9 | nodejs-devel | 1:20.20.2-1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux:9 | nodejs-devel | 1:20.20.2-1.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:10 | nodejs-docs | 1:22.22.2-1.el10_1 | ALSA-2026:7080 |
| AlmaLinux:8 | nodejs-docs | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | nodejs-docs | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:9 | nodejs-docs | 1:20.20.2-1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux:8 | nodejs-full-i18n | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.20.2-1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.20.2-1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.20.2-1.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:8 | nodejs-libs | 1:22.22.2-1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+4006+3c416519 | ALSA-2026:7123 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3982+85c136aa | ALSA-2026:8339 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.5.0+125+8dc38870 | ALSA-2026:7896 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:8 | npm | 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda | ALSA-2026:8339 |
| AlmaLinux:8 | npm | 1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| AlmaLinux:9 | npm | 1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870 | ALSA-2026:7896 |
| AlmaLinux:9 | npm | 1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b | ALSA-2026:7896 |
| AlmaLinux:8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f | ALSA-2026:7123 |
| Debian:12 | node-minimatch | no fix listed | DEBIAN-CVE-2026-27904 |
| Debian:13 | node-minimatch | no fix listed | DEBIAN-CVE-2026-27904 |
| Debian:14 | node-minimatch | 9.0.7-1 | DEBIAN-CVE-2026-27904 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1666+930e28e8 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1667+4a788d89 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1823+b5789597 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1924+614dc87f | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1924+614dc87f | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1666+930e28e8 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1667+4a788d89 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1823+b5789597 | RLSA-2026:8339 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:8339 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:7302 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:7302 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:7896 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:7896 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:7896 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:7302 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:7123 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:8339 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:7302 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:7896 |
| Rocky Linux:10 | nodejs22 | 1:22.22.2-1.el10_1 | RLSA-2026:7080 |
| Ubuntu:22.04:LTS | node-minimatch | no fix listed | UBUNTU-CVE-2026-27904 |
| Ubuntu:24.04:LTS | node-minimatch | no fix listed | UBUNTU-CVE-2026-27904 |
| Ubuntu:25.10 | node-minimatch | no fix listed | UBUNTU-CVE-2026-27904 |
| Ubuntu:26.04:LTS | node-minimatch | no fix listed | UBUNTU-CVE-2026-27904 |
| Ubuntu:26.10 | node-minimatch | no fix listed | UBUNTU-CVE-2026-27904 |
| npm | minimatch | 10.2.3 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | 4.2.5 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | 5.1.8 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | 6.2.2 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | 7.4.8 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | 8.0.6 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | 3.1.4 | GHSA-23c5-xmqv-rm74 |
| npm | minimatch | 9.0.7 | GHSA-23c5-xmqv-rm74 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74 x_refsource_CONFIRM