CVE-2026-27903

What it actually does

This is an algorithmic denial-of-service flaw in the JavaScript minimatch package. Vulnerable versions perform unbounded recursive backtracking in matchOne() when evaluating glob patterns that contain multiple non-adjacent GLOBSTAR segments, such as repeated ** components, against a path that does not match. The matching cost grows binomially with the number of path segments and globstars, and there is no memoization, timeout, or recursion budget to cap evaluation. In Node.js applications, a single crafted glob can block the event loop for seconds to tens of seconds per invocation, causing request latency, worker starvation, build pipeline hangs, or service unavailability. The flaw affects minimatch before 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3; the upstream Git fix is commit ea94840326c3f40522f1b544bd2303024b0eec35.

Why it matters to the business

Systems that accept user-controlled glob patterns may be slowed or made unavailable with small inputs. The most likely impact is operational disruption: stalled CI/CD jobs, delayed builds, unresponsive developer tooling, degraded multi-tenant services, or API workers consumed by expensive pattern matching. The issue has a high availability impact but no direct confidentiality or integrity impact. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at 0.00517, but it has been public for 165 days and is easy to trigger wherever untrusted glob input reaches minimatch.

How an attack unfolds

An attacker first identifies a feature that accepts glob syntax and is evaluated by minimatch, such as file include or exclude rules, ignore patterns, build configuration, linting configuration, user-defined filters, task runner arguments, or tenant-specific matching rules. They then submit a compact glob pattern containing many separated ** segments and cause the application to compare it with paths that do not match. In vulnerable minimatch versions, matchOne() recursively explores a large number of combinations while trying to satisfy the globstars. Because Node.js runs JavaScript on a single event loop per worker, the expensive synchronous computation blocks other work in that process. Repeating the request, commit, configuration update, or build trigger can keep workers or pipelines saturated. Exploitation does not require code execution; it only requires the ability to influence a glob pattern in a path that the application evaluates.

How to fix it

Upgrade minimatch to a fixed release in every dependency path. Fixed versions are 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, with upstream Git fix ea94840326c3f40522f1b544bd2303024b0eec35. Because minimatch is commonly transitive, update lockfiles and rebuild artifacts, not only direct package manifests. Use npm, yarn, pnpm, or the relevant software composition analysis tooling to identify all installed vulnerable minimatch versions. If immediate upgrade is not possible, restrict untrusted glob input: cap pattern length, limit the number of ** segments, reject patterns with repeated non-adjacent globstars, evaluate matching in isolated worker processes with execution time limits, rate-limit endpoints that evaluate globs, and avoid running tenant-supplied glob evaluation in shared long-lived processes.

How to confirm the fix worked

Confirm that all deployed, built, and packaged artifacts resolve minimatch to a fixed version: 10.2.3 or later in the 10.x line, 9.0.7 or later in the 9.x line, 8.0.6 or later in the 8.x line, 7.4.8 or later in the 7.x line, 6.2.2 or later in the 6.x line, 5.1.8 or later in the 5.x line, 4.2.5 or later in the 4.x line, or 3.1.3 or later in the 3.x line. Validate package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, container images, serverless bundles, and vendored node_modules directories. Run dependency scans such as npm ls minimatch, npm audit, yarn why minimatch, pnpm why minimatch, or SCA tooling against the final deployable artifact. Where safe, add regression tests that evaluate hostile multi-globstar patterns and assert bounded execution time. Also confirm that application-level controls reject or isolate untrusted glob patterns with excessive ** usage.

Typical attack path

1. Find an application, build pipeline, developer tool, or multi-tenant feature that accepts glob-style include, exclude, ignore, or filter rules.
2. Confirm or infer that the feature is implemented using a vulnerable minimatch dependency version.
3. Submit a crafted glob containing many non-adjacent ** segments through a request parameter, configuration file, repository file, admin setting, tenant rule, or CI/CD job input.
4. Cause the service or pipeline to evaluate the crafted pattern against paths that do not match.
5. The vulnerable matchOne() routine performs excessive recursive backtracking and blocks the Node.js event loop.
6. Repeat or parallelize submissions to create sustained latency, worker exhaustion, failed builds, or service unavailability.

How to detect it

To determine whether this was already exploited, review logs from features that accept glob, include, exclude, ignore, or filter patterns. Relevant sources include API access logs, application audit logs, admin setting change logs, tenant rule history, CI/CD job logs, build tool output, repository commits containing configuration files, package manager logs, and Node.js process telemetry. Look for short glob values with many ** segments, especially repeated non-adjacent globstars submitted shortly before request timeouts, build hangs, high CPU, event-loop delay alerts, worker restarts, or autoscaling events. Correlate suspicious pattern submissions with spikes in response time, HTTP 408/429/500/502/503/504 responses, job cancellations, container CPU throttling, and Node.js event-loop lag. For forensics, preserve the exact submitted pattern, request metadata, user or automation identity, source IP where available, application logs around the stall, and process metrics. There are no unique malware-style indicators because this vulnerability is triggered through data input rather than dropping files or spawning processes.

• minimatch
• matchOne
• GLOBSTAR
• **/**/**/**/**
• **/*/**/*/**/*/**
• **/a/**/a/**/a/**/a/**
• \*\*/[^\n]*\*\*/[^\n]*\*\*/[^\n]*\*\*/[^\n]*\*\*/
• event loop delay
• event-loop delay
• Event loop blocked
• JavaScript heap out of memory
• Build timed out
• Job timed out
• Request timeout
• HTTP 504
• HTTP 503
• npm ls minimatch
• node_modules/minimatch/package.json
• package-lock.json
• yarn.lock
• pnpm-lock.yaml

What your security team should do

• Prioritize inventory of internet-facing services, CI/CD systems, developer portals, and multi-tenant platforms that accept user-controlled glob patterns.
• Upgrade minimatch to a fixed version across direct and transitive dependencies, and regenerate lockfiles and deployable artifacts.
• Search dependency manifests and lockfiles for vulnerable minimatch versions before 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3.
• Add input validation for glob fields: cap length, limit globstar count, and reject repeated non-adjacent ** segments from untrusted users.
• Run glob evaluation in isolated workers or subprocesses with CPU and wall-clock time limits when untrusted patterns are a required product feature.
• Monitor for sudden increases in Node.js event-loop delay, request latency, worker restarts, build timeouts, and repeated submissions of suspicious glob patterns.
• Create SIEM detections for configuration changes, API requests, commits, or CI job inputs containing repeated ** globstar sequences.
• Treat exploitation as an availability incident: collect pattern inputs, affected endpoints or jobs, timing data, process CPU samples, and tenant or user activity logs before rotating logs.