Is CVE-2026-26996 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26996 being exploited in the wild.

How severe is CVE-2026-26996?

Medium severity, with a CVSS score of 4, published 18 February 2026.

Which products and versions are affected?

isaacs minimatch 3.0.0 to 3.1.2, 4.0.0 to 4.2.3, 5.0.0 to 5.1.6, 6.0.0 to 6.2.0, 7.0.0 to 7.4.6, 8.0.0 to 8.0.4, 9.0.0 to 9.0.5, 10.0.0 to 10.2.0.

Is there a fix for CVE-2026-26996?

A patch was published on 2026-02-16: Fix committed; patched versions released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26996 attacked?

It is attacked over the network.

Am I affected by CVE-2026-26996?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26996: minimatch ReDoS via repeated wildcards with non-matching literal

CVE-2026-26996 · Severity: medium · CVSS 4 · Published 2026-02-18

minimatch is a widely-used npm library for matching glob patterns (wildcard-based file path patterns). A flaw in its pattern compilation allows an attacker to craft malicious glob patterns that cause the underlying regular expression engine to hang indefinitely, consuming 100% CPU. Applications that accept user-controlled glob patterns—such as file search interfaces, build tools, or .gitignore-style filtering systems—can be brought down by a single crafted pattern, resulting in denial of service.

Quick answers

Is CVE-2026-26996 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26996 being exploited in the wild.
How severe is CVE-2026-26996?: Medium severity, with a CVSS score of 4, published 18 February 2026.
Which products and versions are affected?: isaacs minimatch 3.0.0 to 3.1.2, 4.0.0 to 4.2.3, 5.0.0 to 5.1.6, 6.0.0 to 6.2.0, 7.0.0 to 7.4.6, 8.0.0 to 8.0.4, 9.0.0 to 9.0.5, 10.0.0 to 10.2.0.
Is there a fix for CVE-2026-26996?: A patch was published on 2026-02-16: Fix committed; patched versions released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26996 attacked?: It is attacked over the network.
Am I affected by CVE-2026-26996?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

minimatch compiles glob patterns into regular expressions, converting each asterisk (*) to a non-greedy regex group [^/]*?. When a pattern contains many consecutive asterisks (e.g., 15 or more) followed by a literal character that does not appear in the test string, the regex engine must exhaustively backtrack across all possible character distributions before determining no match exists. This results in exponential time complexity: O(4^N) where N is the number of asterisks. Attack vector is network-based if minimatch is exposed via an API accepting user-supplied patterns, with no authentication required and no user interaction necessary. The fix (implemented in the referenced commit) coalesces consecutive non-globstar asterisks into a single regex group, eliminating the exponential backtracking. Patched versions include minimatch 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, and 3.1.3.

Affected products

isaacs minimatch 3.0.0 to 3.1.2, 4.0.0 to 4.2.3, 5.0.0 to 5.1.6, 6.0.0 to 6.2.0, 7.0.0 to 7.4.6, 8.0.0 to 8.0.4, 9.0.0 to 9.0.5, 10.0.0 to 10.2.0

Identifiers

CVE-2026-26996
GHSA-3ppc-4f35-3m26

Timeline

2026-02-17: disclosed: Security advisory GHSA-3ppc-4f35-3m26 published
2026-02-18: advisory: CVE-2026-26996 assigned
2026-02-16: patched: Fix committed; patched versions released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.