CVE-2026-27904
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
Published Feb 26, 2026 · updated Jun 17, 2026 · minimatch project minimatch
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested extglobs produce regexps with nested unbounded quantifiers (e.g. ), which exhibit catastrophic backtracking in V8. With a 12-byte pattern and an 18-byte non-matching input, stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 26, 2026 · NIST NVD
Detected
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested extglobs produce regexps with nested unbounded quantifiers (e.g. ), which exhibit catastrophic backtracking in V8. With a 12-byte pattern and an 18-byte non-matching input, stalls for over 7 seconds. Adding a si
Jun 17, 2026 · NIST NVD
Updated
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested extglobs produce regexps with nested unbounded quantifiers (e.g. ), which exhibit catastrophic backtracking in V8. With a 12-byte pattern and an 18-byte non-matching input, stalls for over 7 seconds. Adding a si
Affected
- cpe minimatch project/minimatchversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-27904
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27904
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested extglobs produce regexps with nested unbounded quantifiers (e.g. ), wh
nvd.nist.gov