Is CVE-2026-118773 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118773 being exploited in the wild.

How severe is CVE-2026-118773?

Medium severity, with a CVSS score of 4, published 29 October 2026.

Which products and versions are affected?

Isaacs Node-Glob 9.0.0 to 14.0.1; glob (npm) >= 9.0.0, <= 14.0.1, SEMVER:introduced=9.0.0,fixed=14.0.2.

Is there a fix for CVE-2026-118773?

Yes. glob (npm): upgrade to 14.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118773 attacked?

It is attacked over the network.

Am I affected by CVE-2026-118773?

Check whether you run Isaacs Node-Glob or glob (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118773: node-glob AbortSignal handling bypass in file traversal

Q: Is there a fix for CVE-2026-118773?

Yes. glob (npm): upgrade to 14.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118773 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-118773?

Check whether you run Isaacs Node-Glob or glob (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118773 · Severity: medium · CVSS 4 · Published 2026-10-29

node-glob is a library that matches file paths against shell-like patterns. When applications use glob to search files and implement a cancellation timeout, an attacker can provide patterns or directory trees that cause the library to ignore the cancellation signal. This allows repeated requests to stack up background filesystem operations, degrading server performance and availability without exposing sensitive data.

Vendors: Isaacs, npm.

Quick answers

Is CVE-2026-118773 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118773 being exploited in the wild.
How severe is CVE-2026-118773?: Medium severity, with a CVSS score of 4, published 29 October 2026.
Which products and versions are affected?: Isaacs Node-Glob 9.0.0 to 14.0.1; glob (npm) >= 9.0.0, <= 14.0.1, SEMVER:introduced=9.0.0,fixed=14.0.2.
Is there a fix for CVE-2026-118773?: Yes. glob (npm): upgrade to 14.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118773 attacked?: It is attacked over the network.
Am I affected by CVE-2026-118773?: Check whether you run Isaacs Node-Glob or glob (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

glob (npm): upgrade to 14.0.2 or later
```
npm install glob@14.0.2
```

Technical details

An improper AbortSignal handling vulnerability in node-glob versions 9.0.0 through 14.0.1 allows callbacks in src/walker.ts (GlobUtil.walkCB, walkCB2, walkCBSync, walkCB2Sync) to execute without returning after signal abort, permitting execution to continue into processor.processPatterns() and recursive traversal. The attack requires attacker-influenced glob patterns or directory trees and leverages the application's reliance on cancellation as a traversal budget; exploitation causes denial of service through resource exhaustion.

Affected products

isaacs node-glob 9.0.0 to 14.0.1

Identifiers

CVE-2026-118773
GHSA-3g3m-2fjr-6pw4

Timeline

2026-10-29: disclosed
2026-10-27: patched: Fixed in version 14.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.