CVE-2026-118773: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
Vulnerability summary
CVE-2026-118773 is a medium (CVSS 6.3) Uncontrolled Resource Consumption vulnerability in isaacs node-glob. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 28.7% of scored vulnerabilities.
Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 29-10-2026PublishedVulnerability first disclosed.
- 30-10-2026Last modifiedVulnerability information updated.
Description
Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.
CVSS metrics
7 scores · 7 sources · 1 version- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · NpmEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
29%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard39 products
- actions-runnerAll versions (No fix recorded) | < 2.338.2-r2
- airflow-2All versions (No fix recorded)
- arangodb-3.12All versions (No fix recorded)
- eco-jessAll versions (No fix recorded)
- gemini-cliAll versions (No fix recorded)
Wolfi6 products
- langfuse-3-workerAll versions (No fix recorded)
- lernaAll versions (No fix recorded)
- npm-12All versions (No fix recorded)
- renovateAll versions (No fix recorded) | < 44.198.3-r1
- tileserver-glAll versions (No fix recorded) | < 5.7.0-r2
Debian1 product
- node-globAll versions (No fix recorded)
Isaacs1 product
- node-glob≥ 9.0.0, < 14.0.2
Npm1 product
- glob≥ 9.0.0, < 14.0.2
Ubuntu1 product
- node-globAll versions (No fix recorded)
6 vendors · 49 products
References
9 links- github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4X Refsource CONFIRMWEBREPORTAdvisory
- github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7X Refsource MISCWEBREPORTFIX
- github.com/isaacs/node-globPACKAGE