CVE-2026-26996

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26996
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26996.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-26996
Aliases
Downstream
ALSA (7)
CGA (526)
CLEANSTART (10)
CLSA (22)
DEBIAN (1)
ECHO (1)
MINI (44)
openSUSE (10)
RHSA (16)
RLSA (8)
ROOT (1)
SUSE (24)
UBUNTU (1)
Related
ALSA (7)
openSUSE (10)
SUSE (24)
Published
2026-02-20T03:05:21Z
Modified
2026-10-28T02:30:52Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
Details

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1333"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26996.json"
}
References

Affected packages

Git / github.com/isaacs/minimatch

Affected ranges

Type
GIT
Repo
https://github.com/isaacs/minimatch
Events
Introduced
270dbea567f0af6918cb18103e98c612aa717a20
Fixed
00c323b188b704e5d4bc534ecec2268cfa70a32a
Introduced
26d281dc585af91df47cb93844e227e0ee90b7ce
Fixed
63edb3d6d00eb57ee7fdea89740a90d2323d065f
Introduced
fc44f5f9123f534ecbf76af65558eb87d90f1028
Fixed
85646c8f2739fdb0bc3b744606117a9d63f97c74
Introduced
31f61eeaa6c4493f81bf5eb0a146f23e538fdfd7
Fixed
8ce798c2023dfda846bcd236b9121118d3278b73
Introduced
ce9e6a4b42eb8a4c39eff1258affa9d37c66101b
Fixed
926c3129f46c428fdf651bbe73ca906fe8b42307
Introduced
5d20578d5749f53f3413b7ca413e5658d6ab0d05
Fixed
f4ce011fce4be95c6af74182a772c92df83e6722
Introduced
b95cb1e4404ce374e447b3b1bfde837e74f139bd
Fixed
7117ef381e74deace1c62a74d2298c8fe61d10ca
Introduced
346685ced5203464bb10fd3d4dfa6964f6102ede
Fixed
6d7ac34de6979f0b028b34fecd40349cd4dde186
Fixed
2e111f3a79abc00fa73110195de2c0f2351904f5
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.1.3"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.2.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "5.0.0"
                },
                {
                    "fixed": "5.1.7"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.4.7"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.0.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.0.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "10.0.0"
                },
                {
                    "fixed": "10.2.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "2e111f3a79abc00fa73110195de2c0f2351904f5"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v10.*
v10.0.0
v10.0.1
v10.0.2
v10.0.3
v10.1.0
v10.1.1
v10.1.2
v10.1.3
v10.2.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.1.0
v3.1.1
v3.1.2
v4.*
v4.0.0
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v5.*
v5.0.0
v5.0.1
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.5
v5.1.6
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.1.0
v6.1.1
v6.1.10
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v6.1.6
v6.1.7
v6.1.8
v6.1.9
v6.2.0
v7.*
v7.0.0
v7.0.1
v7.1.0
v7.1.1
v7.1.2
v7.1.3
v7.1.4
v7.2.0
v7.3.0
v7.4.0
v7.4.1
v7.4.2
v7.4.3
v7.4.4
v7.4.5
v7.4.6
v8.*
v8.0.0
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.0.4
v9.0.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26996.json"