GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-27904 (GCVE-0-2026-27904)

Vulnerability from cvelistv5 – Published: 2026-02-26 01:07 – Updated: 2026-02-26 19:21
VLAI
Title
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Summary
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-26 19:21 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
Impacted products
Vendor Product Version CPE status
isaacs minimatch Affected: >= 10.0.0, < 10.2.3
Affected: >= 9.0.0, < 9.0.7
Affected: >= 8.0.0, < 8.0.6
Affected: >= 7.0.0, < 7.4.8
Affected: >= 6.0.0, < 6.2.2
Affected: >= 5.0.0, < 5.1.8
Affected: >= 4.0.0, < 4.2.5
Affected: < 3.1.4
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27904",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T19:21:18.964387Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T19:21:39.006Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "minimatch",
          "vendor": "isaacs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.0.0, \u003c 10.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.4.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.1.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.2.5"
            },
            {
              "status": "affected",
              "version": "\u003c 3.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-26T01:07:42.693Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
        }
      ],
      "source": {
        "advisory": "GHSA-23c5-xmqv-rm74",
        "discovery": "UNKNOWN"
      },
      "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27904",
    "datePublished": "2026-02-26T01:07:42.693Z",
    "dateReserved": "2026-02-24T15:19:29.718Z",
    "dateUpdated": "2026-02-26T19:21:39.006Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-27904",
      "date": "2026-09-16",
      "epss": "0.00472",
      "percentile": "0.39721"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-27904\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-26T02:16:21.760\",\"lastModified\":\"2026-06-17T10:27:51.297\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.\"},{\"lang\":\"es\",\"value\":\"minimatch es una utilidad de coincidencia m\u00ednima para convertir expresiones glob en objetos RegExp de JavaScript. Antes de las versiones 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5 y 3.1.4, los extglobs anidados \u0027*( )\u0027 producen regexps con cuantificadores anidados ilimitados (por ejemplo, \u0027(?:(?:a|b)*)*\u0027), que exhiben retroceso catastr\u00f3fico en V8. Con un patr\u00f3n de 12 bytes \u0027*(*(*(a|b)))\u0027 y una entrada no coincidente de 18 bytes, \u0027minimatch()\u0027 se detiene durante m\u00e1s de 7 segundos. A\u00f1adir un solo nivel de anidamiento o unos pocos caracteres de entrada eleva esto a minutos. Este es el hallazgo m\u00e1s grave: se activa por la API predeterminada de \u0027minimatch()\u0027 sin opciones especiales, y el patr\u00f3n m\u00ednimo viable es de solo 12 bytes. El mismo problema afecta a los extglobs \u0027+()\u0027 por igual. Las versiones 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5 y 3.1.4 solucionan el problema.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"isaacs\",\"product\":\"minimatch\",\"versions\":[{\"version\":\"\u003e= 10.0.0, \u003c 10.2.3\",\"status\":\"affected\"},{\"version\":\"\u003e= 9.0.0, \u003c 9.0.7\",\"status\":\"affected\"},{\"version\":\"\u003e= 8.0.0, \u003c 8.0.6\",\"status\":\"affected\"},{\"version\":\"\u003e= 7.0.0, \u003c 7.4.8\",\"status\":\"affected\"},{\"version\":\"\u003e= 6.0.0, \u003c 6.2.2\",\"status\":\"affected\"},{\"version\":\"\u003e= 5.0.0, \u003c 5.1.8\",\"status\":\"affected\"},{\"version\":\"\u003e= 4.0.0, \u003c 4.2.5\",\"status\":\"affected\"},{\"version\":\"\u003c 3.1.4\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-02-26T19:21:18.964387Z\",\"id\":\"CVE-2026-27904\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"3.1.4\",\"matchCriteriaId\":\"41106C86-4D1E-40C7-851F-2564462205C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.2.5\",\"matchCriteriaId\":\"39C23B15-E8E5-4847-A6EF-0940FA9F26BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndExcluding\":\"5.1.8\",\"matchCriteriaId\":\"DA03D53D-D7C4-424A-A3BA-C8C3B90D3EA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.2.2\",\"matchCriteriaId\":\"B3677470-9515-47D2-B5FB-4FA1F700ED55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.4.8\",\"matchCriteriaId\":\"A34E360D-31EA-43CF-957E-5D2208076EBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.0.6\",\"matchCriteriaId\":\"6391D830-3745-4C96-A6CF-A6C75CC221A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.0.7\",\"matchCriteriaId\":\"3E6BE4CC-B5A1-4FC8-8776-9BEA2B10F6D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.2.3\",\"matchCriteriaId\":\"5B5B4C6E-7FBB-4C95-BD32-B3A16C6B1E5B\"}]}]}],\"references\":[{\"url\":\"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T18:30:58+00:00",
      "cve": "CVE-2026-27904",
      "id": "CVE-2026-27904",
      "initial_release_date": "2026-02-26T01:07:42.693000+00:00",
      "product_status:fixed": "653",
      "product_status:known_affected": "74",
      "product_status:known_not_affected": "3879",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27904.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T02:11:04Z",
      "cve": "CVE-2026-27904",
      "id": "CVE-2026-27904",
      "initial_release_date": "2026-02-28T00:24:27Z",
      "product_status:known_affected": "551",
      "product_status:known_not_affected": "400",
      "product_status:recommended": "172",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-27904",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-27904.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-27904\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-26T19:21:18.964387Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-26T19:21:29.476Z\"}}], \"cna\": {\"title\": \"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\", \"source\": {\"advisory\": \"GHSA-23c5-xmqv-rm74\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"isaacs\", \"product\": \"minimatch\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 10.0.0, \u003c 10.2.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 9.0.0, \u003c 9.0.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0, \u003c 8.0.6\"}, {\"status\": \"affected\", \"version\": \"\u003e= 7.0.0, \u003c 7.4.8\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.0.0, \u003c 6.2.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 5.0.0, \u003c 5.1.8\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 4.2.5\"}, {\"status\": \"affected\", \"version\": \"\u003c 3.1.4\"}]}], \"references\": [{\"url\": \"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74\", \"name\": \"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1333\", \"description\": \"CWE-1333: Inefficient Regular Expression Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-26T01:07:42.693Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-27904\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-26T19:21:39.006Z\", \"dateReserved\": \"2026-02-24T15:19:29.718Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-26T01:07:42.693Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.