CVE-2026-27904

What it actually does

Affected versions of minimatch generate JavaScript regular expressions with nested, unbounded quantifiers when processing nested extglob patterns using constructs such as *() or +(). In V8, these generated expressions can trigger catastrophic backtracking against short non-matching inputs, causing a single minimatch() call to consume CPU for seconds to minutes. The flaw affects the default minimatch() API and does not require special options. The impact is availability loss: confidentiality and integrity are not directly affected, but Node.js processes, worker threads, request handlers, build jobs, or automation tasks that evaluate attacker-controlled glob patterns or candidate strings can stall.

Why it matters to the business

Applications, APIs, developer platforms, CI/CD jobs, file-processing services, or automation systems that pass untrusted glob patterns into minimatch can be made slow or unavailable with very small inputs. Because minimatch is commonly used directly and as a transitive dependency in JavaScript tooling, exposure may exist even where the package was not intentionally selected. The vulnerability has a high availability CVSS impact, but it is not currently listed in CISA KEV, is not associated with ransomware use, and has low EPSS at the time of assessment; prioritization should therefore focus on internet-facing or multi-tenant services that accept user-controlled patterns.

How an attack unfolds

An attacker first identifies functionality that accepts glob-like input, such as file filters, path matchers, ignore rules, search filters, artifact selectors, repository tooling, or upload/download selection logic. The attacker submits a short nested extglob pattern using repeated *() or +() nesting, then provides or causes evaluation against a non-matching candidate string. Vulnerable minimatch versions translate that pattern into a regular expression containing nested unbounded quantifiers. When V8 evaluates the expression, it explores a very large backtracking search space before determining there is no match. Repeating the request or increasing nesting/input length can pin the Node.js event loop or worker CPU, causing request timeouts, queue buildup, container restarts, failed jobs, or service degradation.

How to fix it

Upgrade minimatch to a fixed version appropriate for the major version in use: 10.2.3 or later, 9.0.7 or later, 8.0.6 or later, 7.4.8 or later, 6.2.2 or later, 5.1.8 or later, 4.2.5 or later, or 3.1.4 or later. The upstream Git fix is identified as commit ea94840326c3f40522f1b544bd2303024b0eec35. Update package-lock.json, npm-shrinkwrap.json, yarn.lock, or pnpm-lock.yaml so transitive dependency resolution also moves to a fixed version. Where immediate upgrade is not possible, reject or strictly constrain user-supplied extglob syntax, especially nested *() and +() groups; enforce maximum pattern length, nesting depth, and match time; run risky matching in isolated workers with CPU/time limits; and apply rate limiting to endpoints that evaluate glob patterns.

How to confirm the fix worked

Confirm dependency resolution with package-manager tooling such as npm ls minimatch, yarn why minimatch, pnpm why minimatch, or SBOM/SCA scans, and verify no resolved minimatch package is below the fixed versions for its major line. Inspect lockfiles for minimatch versions earlier than 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, or 3.1.4. After upgrading, run a regression test that evaluates nested extglob patterns against non-matching strings and confirm the operation returns quickly rather than stalling. Validate production protection by checking that user-controlled glob inputs are length-limited, nesting-limited, logged, and rate-limited where applicable.

Typical attack path

1. Find an endpoint, job parameter, configuration field, or workflow that accepts glob patterns or file-matching expressions.
2. Confirm the application uses minimatch directly or through a dependency path to evaluate those patterns.
3. Submit a nested extglob pattern using *() or +() constructs, such as a small pattern with multiple nested groups.
4. Cause the pattern to be matched against a short non-matching input string.
5. Trigger catastrophic backtracking in the generated JavaScript regular expression, consuming CPU in the Node.js process.
6. Repeat or parallelize requests to exhaust workers, increase latency, cause timeouts, or disrupt dependent services.

How to detect it

This vulnerability does not produce a durable compromise artifact because it causes denial of service rather than code execution, so detection should focus on evidence of attempted triggering and correlated resource exhaustion. Review application logs, API gateway logs, WAF logs, reverse proxy logs, job execution logs, CI/CD logs, and audit trails for user-supplied glob patterns containing nested *() or +() extglob syntax. Correlate those requests with spikes in Node.js CPU usage, event-loop lag, request duration, HTTP 408/429/499/500/502/503/504 responses, worker thread saturation, container restarts, process manager restarts, failed build steps, or timeout errors. In Node.js telemetry, look for long synchronous JavaScript execution in RegExp evaluation or minimatch-related stack traces. Because exploit maturity is currently reported as none and the issue is not in KEV, treat confirmed suspicious patterns plus service impact as the strongest signal of attempted exploitation.

• *(*(*(a|b)))
• +(*(*(a|b)))
• +(+(*(a|b)))
• *(*(*(
• +(+(+(
• (?:(?:a|b)*)*
• (?:(?:a|b)+)*
• node_modules/minimatch/package.json
• minimatch()
• RegExp.prototype.test
• event loop lag
• request timeout
• worker timeout
• JavaScript heap out of memory

What your security team should do

• Inventory all direct and transitive uses of minimatch across application repositories, container images, serverless packages, CI/CD tooling, and developer automation.
• Prioritize remediation for internet-facing, multi-tenant, or unauthenticated functionality that accepts glob patterns, file filters, path selectors, ignore rules, or similar matching expressions.
• Upgrade minimatch to the fixed version for the deployed major line and refresh lockfiles to ensure transitive dependencies are actually updated.
• Add input validation to reject deeply nested extglob constructs and enforce maximum glob pattern length and nesting depth.
• Add runtime safeguards for pattern matching, such as worker isolation, request timeouts, event-loop lag monitoring, CPU quotas, and rate limits.
• Search historical application and edge logs for nested extglob patterns, correlated request timeouts, high CPU, event-loop stalls, worker restarts, or failed jobs.
• Add SCA policy checks so vulnerable minimatch versions fail builds or deployment gates going forward.