CVE-2026-26996

What it actually does

minimatch versions 10.2.0 and earlier can generate JavaScript regular expressions with catastrophic backtracking when the glob pattern contains many consecutive asterisks followed by a literal character that is not present in the string being matched. Each '*' becomes a separate lazy '[^/]*?' group; when the match ultimately fails, V8 explores an exponentially growing number of ways to split the input across those groups. The result is CPU exhaustion and event-loop blocking in Node.js applications that pass attacker-controlled input as the minimatch pattern. The impact is availability loss, not data disclosure or code execution.

Why it matters to the business

Applications that expose glob, path-filter, search, routing, allowlist, denylist, file-selection, or rule-matching features backed by minimatch may be remotely slowed or made unavailable with a small request payload. Because exploitation requires no authentication in exposed use cases and public exploit techniques are available, internet-facing services using vulnerable minimatch versions should be prioritized even though this issue is not currently listed in CISA KEV and has a low EPSS score. Operationally, successful exploitation can cause request timeouts, failed jobs, degraded APIs, container restarts, autoscaling cost spikes, and denial of service for legitimate users.

How an attack unfolds

An attacker first identifies application functionality where user input is interpreted as a glob pattern, such as file matching, artifact selection, include/exclude rules, path filters, package filters, or search masks. They then submit a pattern containing many consecutive '*' characters followed by a literal character that is absent from the target string being evaluated. When the application calls minimatch() with that attacker-supplied value as the pattern, minimatch compiles the glob into a regular expression containing many adjacent lazy wildcard groups. If the candidate string does not contain the trailing literal, the regex engine repeatedly backtracks across possible wildcard splits. With enough consecutive asterisks, one request can pin the Node.js event loop for seconds or indefinitely; repeated requests can exhaust worker capacity and make the service unavailable.

How to fix it

Upgrade minimatch to version 10.2.1 or later. For source-based consumers, ensure the fix containing commit 6d7ac34de6979f0b028b34fecd40349cd4dde186 is present. Rebuild and redeploy applications after dependency updates, and verify lockfiles are updated so transitive dependencies do not continue resolving to minimatch 10.2.0 or earlier. If immediate upgrade is not possible, mitigate by rejecting or normalizing user-supplied glob patterns with excessive consecutive '*' characters, imposing strict maximum pattern length and wildcard-run length, applying request timeouts, isolating glob evaluation from the main event loop where feasible, rate-limiting unauthenticated pattern-matching endpoints, and avoiding passing untrusted input as the minimatch pattern argument.

How to confirm the fix worked

Confirm dependency resolution shows minimatch 10.2.1 or later in package manifests and lockfiles, including transitive dependency trees. Use package-audit tooling, software composition analysis, or commands such as npm ls minimatch, pnpm why minimatch, or yarn why minimatch to identify remaining vulnerable versions. In staging, exercise legitimate glob functionality and verify behavior remains correct. Also test that patterns with long consecutive '*' runs are rejected, normalized, or complete quickly without event-loop stalls. Operational validation should include monitoring CPU, Node.js event-loop delay, request latency, timeout rates, and worker restarts before and after remediation.

Typical attack path

1. Find an API, web form, CLI-backed service, CI/CD workflow, repository browser, file filter, or rule engine that accepts glob-style patterns from users.
2. Confirm the application uses minimatch or a downstream package that invokes minimatch with the user value as the pattern argument.
3. Submit a crafted glob containing a long run of consecutive '*' characters followed by a literal character unlikely to appear in the matched string.
4. Trigger matching against one or more candidate strings that do not contain the trailing literal character.
5. Cause catastrophic regex backtracking inside the Node.js process, blocking the event loop and consuming CPU.
6. Repeat the request or target multiple workers to produce sustained service degradation or outage.

How to detect it

Review application, API gateway, reverse proxy, WAF, and load balancer logs for requests containing unusually long runs of asterisks in parameters or JSON fields used for glob-style matching, particularly names such as pattern, glob, filter, include, excludes, path, files, mask, rule, matcher, or search. Include URL-decoded searches for repeated '%2A' sequences. Correlate these requests with sudden increases in Node.js CPU utilization, event-loop lag, request latency, worker saturation, 499/502/503/504 responses, application-level timeout errors, container restarts, and process supervisor restarts. In APM traces, look for long spans or stalled requests around minimatch(), path filtering, rule matching, file selection, or repository/artifact search operations. Because exploitation primarily causes denial of service and may not write files or spawn processes, absence of host artifacts does not rule out exploitation; the strongest evidence is a suspicious wildcard-heavy request immediately preceding resource exhaustion.

• ***************a
• **********************************a
• %2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2Aa
• %2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2Aa
• pattern=***************
• glob=***************
• filter=***************
• include=***************
• exclude=***************
• mask=***************
• "pattern":"***************
• "glob":"***************
• "filter":"***************
• "include":"***************
• "exclude":"***************
• "mask":"***************
• minimatch(
• event loop delay
• JavaScript heap out of memory
• Request timeout
• upstream timed out
• HTTP 504
• HTTP 503

What your security team should do

• Inventory all JavaScript and Node.js applications, build tools, CLIs, CI/CD components, and services that include minimatch directly or transitively.
• Prioritize internet-facing or unauthenticated features that accept glob-like user input, especially pattern, path, include, exclude, filter, mask, or rule parameters.
• Upgrade minimatch to 10.2.1 or later and refresh lockfiles; verify the fixed commit 6d7ac34de6979f0b028b34fecd40349cd4dde186 is included where source builds are used.
• Add input validation that limits pattern length and blocks long consecutive '*' runs before glob evaluation.
• Add or tune rate limits, request timeouts, circuit breakers, and event-loop delay alerts for endpoints that perform pattern matching.
• Search historical logs for suspicious long wildcard runs and correlate with CPU spikes, request timeouts, 502/503/504 responses, container restarts, or Node.js process restarts.
• Create regression tests for pathological glob patterns so future dependency or code changes do not reintroduce ReDoS behavior.