CVE-2026-27904: minimatch nested extglob ReDoS via catastrophic backtracking

CVE-2026-27904 · Severity: low · CVSS 3.1 · Published 2026-02-26

minimatch is a JavaScript glob pattern matching library used by npm and build tools. Nested extended glob patterns like `*(*(a|b))` generate regular expressions with nested quantifiers that cause the regex engine to hang for seconds or minutes when processing non-matching input. An attacker who can control glob patterns in build pipelines or file path matching operations can trigger denial-of-service by stalling the event loop.

Quick answers

Is CVE-2026-27904 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27904 being exploited in the wild.
How severe is CVE-2026-27904?
Low severity, with a CVSS score of 3.1, published 26 February 2026.
Which products and versions are affected?
isaacs minimatch >=0.0.0, <=3.1.3; >=4.0.0, <4.2.5; >=5.0.0, <5.1.8; >=6.0.0, <6.2.2; >=7.0.0, <7.4.8; >=8.0.0, <8.0.6; >=9.0.0, <9.0.7; >=10.0.0, <10.2.3.
Is there a fix for CVE-2026-27904?
A patch was published on 2026-02-25: Patched versions released: 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27904 attacked?
It is attacked over the network.
Am I affected by CVE-2026-27904?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a Regular Expression Denial of Service (ReDoS) vulnerability in the glob pattern compiler. The root cause is in AST.toRegExpSource() at src/ast.ts#L598, where nested extglobs (e.g., `*()` and `+()` operators) produce unbounded quantifiers that wrap recursively: `*(a|b)` becomes `/^(?:a|b)*$/`, but `*(*(a|b))` becomes `/^(?:(?:a|b)*)*$/`. These nested quantifiers exhibit catastrophic backtracking in V8 when matching against adversarial non-matching input (e.g., repeated 'a' characters followed by 'z'). A 12-byte pattern with 18-byte input can stall for 7+ seconds; additional nesting levels or input length push execution time to minutes. The vulnerability is triggered through the default minimatch() API without special options. Patches have been released in versions 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, and 10.2.3.

Affected products

  • isaacs minimatch >=0.0.0, <=3.1.3; >=4.0.0, <4.2.5; >=5.0.0, <5.1.8; >=6.0.0, <6.2.2; >=7.0.0, <7.4.8; >=8.0.0, <8.0.6; >=9.0.0, <9.0.7; >=10.0.0, <10.2.3

Identifiers

  • CVE-2026-27904
  • GHSA-23c5-xmqv-rm74

Timeline

  • 2026-02-25: disclosed: Vulnerability published on GitHub advisories
  • 2026-02-25: patched: Patched versions released: 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.