CVE-2026-27903: minimatch ReDoS in matchOne via multiple non-adjacent GLOBSTAR segments

CVE-2026-27903 · Severity: low · CVSS 3.1 · Published 2026-02-26

minimatch is a widely-used JavaScript library for matching file paths against glob patterns. A flaw in the matchOne() function causes combinatorial backtracking when processing glob patterns with multiple non-adjacent `**` (GLOBSTAR) segments against non-matching paths. An attacker can craft a malicious glob pattern that causes the application to stall for seconds, freezing the entire Node.js event loop and blocking all concurrent users from being served—enabling denial-of-service attacks on build tools, CI/CD pipelines, web servers, and other services that accept user-supplied glob patterns.

Technologies: minimatch (npm). Vendors: npm.

Quick answers

Is CVE-2026-27903 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27903 being exploited in the wild.
How severe is CVE-2026-27903?
Low severity, with a CVSS score of 3.1, published 26 February 2026.
Which products and versions are affected?
minimatch (npm) SEMVER:introduced=10.0.0,fixed=10.2.3.
Is there a fix for CVE-2026-27903?
Yes. minimatch (npm): upgrade to 10.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27903 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-27903?
Check whether you run minimatch (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • minimatch (npm): upgrade to 10.2.3 or later
    npm install minimatch@10.2.3

Technical details

This is a Regular Expression Denial of Service (ReDoS) vulnerability caused by unbounded recursive backtracking in the matchOne() function at src/index.ts#L960. When a glob pattern contains k non-adjacent GLOBSTAR (`**`) segments and the input path has n segments, the function explores a call tree with O(C(n,k)) complexity—binomial coefficient. For example, k=11 globstars with n=30 path segments causes ~5.4 seconds of stalling; k=13 causes ~15.9 seconds. The vulnerability requires no special options—the default minimatch() API is affected. Attack surface includes build tools (ESLint, Webpack, Rollup), multi-tenant systems with glob-based rules, CI/CD pipelines, and any service accepting user-controlled glob patterns. Patches are available in versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3.

Affected products

  • isaacs minimatch >=0.0.0, <3.1.3; >=4.0.0, <4.2.5; >=5.0.0, <5.1.8; >=6.0.0, <6.2.2; >=7.0.0, <7.4.8; >=8.0.0, <8.0.6; >=9.0.0, <9.0.7; >=10.0.0, <10.2.3

Identifiers

  • CVE-2026-27903
  • GHSA-7r86-cg39-jmmj

Timeline

  • 2026-02-26: disclosed: GHSA-7r86-cg39-jmmj published
  • 2026-02-25: advisory: GitHub security advisory issued by maintainer

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.