# CVE-2026-27903: minimatch ReDoS in matchOne via multiple non-adjacent GLOBSTAR segments

Source: https://junglewise.ai/threats/cve-2026-27903-minimatch-redos-in-matchone-via-multiple-non-adjacent-globstar  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-27903 · Severity: low · CVSS 3.1 · Published 2026-02-26

minimatch is a widely-used JavaScript library for matching file paths against glob patterns. A flaw in the matchOne() function causes combinatorial backtracking when processing glob patterns with multiple non-adjacent `**` (GLOBSTAR) segments against non-matching paths. An attacker can craft a malicious glob pattern that causes the application to stall for seconds, freezing the entire Node.js event loop and blocking all concurrent users from being served—enabling denial-of-service attacks on build tools, CI/CD pipelines, web servers, and other services that accept user-supplied glob patterns.

Technologies: [minimatch (npm)](https://junglewise.ai/threats/technologies/minimatch). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-27903 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27903 being exploited in the wild.

**How severe is CVE-2026-27903?** Low severity, with a CVSS score of 3.1, published 26 February 2026.

**Which products and versions are affected?** minimatch (npm) SEMVER:introduced=10.0.0,fixed=10.2.3.

**Is there a fix for CVE-2026-27903?** Yes. minimatch (npm): upgrade to 10.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27903 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27903?** Check whether you run minimatch (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- minimatch (npm): upgrade to 10.2.3 or later

  ```sh
  npm install minimatch@10.2.3
  ```


## Technical details

This is a Regular Expression Denial of Service (ReDoS) vulnerability caused by unbounded recursive backtracking in the matchOne() function at src/index.ts#L960. When a glob pattern contains k non-adjacent GLOBSTAR (`**`) segments and the input path has n segments, the function explores a call tree with O(C(n,k)) complexity—binomial coefficient. For example, k=11 globstars with n=30 path segments causes ~5.4 seconds of stalling; k=13 causes ~15.9 seconds. The vulnerability requires no special options—the default minimatch() API is affected. Attack surface includes build tools (ESLint, Webpack, Rollup), multi-tenant systems with glob-based rules, CI/CD pipelines, and any service accepting user-controlled glob patterns. Patches are available in versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3.

## Affected products

- isaacs minimatch >=0.0.0, <3.1.3; >=4.0.0, <4.2.5; >=5.0.0, <5.1.8; >=6.0.0, <6.2.2; >=7.0.0, <7.4.8; >=8.0.0, <8.0.6; >=9.0.0, <9.0.7; >=10.0.0, <10.2.3

## Identifiers

- CVE-2026-27903
- GHSA-7r86-cg39-jmmj

## Timeline

- 2026-02-26: disclosed: GHSA-7r86-cg39-jmmj published
- 2026-02-25: advisory: GitHub security advisory issued by maintainer

## References

- [https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj](https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj)

## Related threats

- [minimatch ReDoS in glob pattern compilation](https://junglewise.ai/threats/cve-2026-118764-minimatch-is-a-minimal-matching-utility-for-converting-glob)
- [minimatch ReDoS vulnerability in braceExpand](https://junglewise.ai/threats/cve-2022-3517-minimatch-redos-vulnerability-in-braceexpand)
- [minimatch regular expression denial of service](https://junglewise.ai/threats/cve-2016-10540-minimatch-regular-expression-denial-of-service)