CVE-2026-26996

Description

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

CVSS Metrics

• v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.53%• Percentile: 44%

Techniques & Countermeasures

• CWE-1333•Inefficient Regular Expression Complexity

  The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Affected Systems

• chainguard•actions-runner

  < 2.332.0-r0

• chainguard•airflow-2

  all

• chainguard•airflow-core-2

  all

• chainguard•arangodb-3.11

  < 3.11.14.3-r1

• chainguard•arangodb-3.12

  < 3.12.7.2-r1 | < 3.12.7.2-r2

• chainguard•argo-workflows-ui-3.6

  < 3.6.19-r2 | < 3.6.19-r5

• chainguard•argo-workflows-ui-3.7

  < 3.7.13-r0 | < 3.7.10-r3

• chainguard•argo-workflows-ui-4.0

  < 4.0.4-r6 | < 4.0.1-r2

• chainguard•authentik-2025.12

  all

• chainguard•authentik-2026.2

  < 2026.2.4-r9

• chainguard•authentik-fips-2025.12

  all

• chainguard•authentik-fips-2026.2

  < 2026.2.4-r8

• chainguard•bash-language-server

  < 5.6.0-r4

• chainguard•code-server

  < 4.106.3-r5

• chainguard•drupal-11.3

  < 11.3.13-r1

• chainguard•emscripten

  < 5.0.1-r2

• chainguard•eslint

  < 10.0.1-r0

• chainguard•foxx-cli

  < 2.1.1-r4

• chainguard•gemini-cli

  < 0.30.0-r0

• chainguard•gitlab-rails-ce-18.1

  all

• chainguard•gitlab-rails-ce-18.10

  all

• chainguard•gitlab-rails-ce-18.11

  < 18.11.6-r7

• chainguard•gitlab-rails-ce-18.5

  all

• chainguard•gitlab-rails-ce-18.6

  all

• chainguard•gitlab-rails-ce-18.7

  all

• chainguard•gitlab-rails-ce-18.8

  all

• chainguard•gitlab-rails-ce-18.9

  all

• chainguard•gitlab-rails-ce-19.0

  all | < 19.0.3-r1

• chainguard•gitlab-rails-ce-19.1

  all | < 19.1.7-r6

• chainguard•gitlab-rails-ce-19.2

  all | < 19.2.5-r2

• chainguard•gitlab-rails-ce-19.3

  < 19.3.1-r6

• chainguard•gitlab-rails-ce-fips-18.1

  < 18.1.6-r15 | all

• chainguard•gitlab-rails-ce-fips-18.10

  all

• chainguard•gitlab-rails-ce-fips-18.11

  < 18.11.7-r1

• chainguard•gitlab-rails-ce-fips-18.5

  all

• chainguard•gitlab-rails-ce-fips-18.6

  all

• chainguard•gitlab-rails-ce-fips-18.7

  all

• chainguard•gitlab-rails-ce-fips-18.8

  all

• chainguard•gitlab-rails-ce-fips-18.9

  all

• chainguard•gitlab-rails-ce-fips-19.0

  all

• chainguard•gitlab-rails-ce-fips-19.1

  all | < 19.1.1-r1 | < 19.1.7-r7

• chainguard•gitlab-rails-ce-fips-19.2

  all | < 19.2.5-r2

• chainguard•gitlab-rails-ce-fips-19.3

  < 19.3.1-r3

• chainguard•graalvm-24-ce-nodejs

  all

• chainguard•graalvm-25-ce-nodejs

  < 25.0.2-r3

• chainguard•jupyter-base-notebook

  all

• chainguard•katib-earlystopping

  < 0.19.0-r23

• chainguard•katib-suggestion-goptuna-compat

  all

• chainguard•katib-suggestion-hyperband

  < 0.19.0-r23

• chainguard•katib-suggestion-hyperopt

  < 0.19.0-r23 | < 0.19.0-r40

Showing first 50 affected entries in server-rendered view.

References (6)

• https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
• https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
• https://nvd.nist.gov/vuln/detail/CVE-2026-26996
• https://github.com/isaacs/minimatch
• https://security-tracker.debian.org/tracker/CVE-2026-26996
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26996.json