Executive brief
minimatch is a widely-used npm library for matching glob patterns (wildcard-based file path patterns). A flaw in its pattern compilation allows an attacker to craft malicious glob patterns that cause the underlying regular expression engine to hang indefinitely, consuming 100% CPU. Applications that accept user-controlled glob patterns—such as file search interfaces, build tools, or .gitignore-style filtering systems—can be brought down by a single crafted pattern, resulting in denial of service.
Technical details
minimatch compiles glob patterns into regular expressions, converting each asterisk (*) to a non-greedy regex group [^/]*?. When a pattern contains many consecutive asterisks (e.g., 15 or more) followed by a literal character that does not appear in the test string, the regex engine must exhaustively backtrack across all possible character distributions before determining no match exists. This results in exponential time complexity: O(4^N) where N is the number of asterisks. Attack vector is network-based if minimatch is exposed via an API accepting user-supplied patterns, with no authentication required and no user interaction necessary. The fix (implemented in the referenced commit) coalesces consecutive non-globstar asterisks into a single regex group, eliminating the exponential backtracking. Patched versions include minimatch 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, and 3.1.3.
Affected products
- isaacs minimatch 3.0.0 to 3.1.2, 4.0.0 to 4.2.3, 5.0.0 to 5.1.6, 6.0.0 to 6.2.0, 7.0.0 to 7.4.6, 8.0.0 to 8.0.4, 9.0.0 to 9.0.5, 10.0.0 to 10.2.0
Timeline
- 2026-02-17: disclosed: Security advisory GHSA-3ppc-4f35-3m26 published
- 2026-02-18: advisory: CVE-2026-26996 assigned
- 2026-02-16: patched: Fix committed; patched versions released