8.7

CVE-2026-26996: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Analyzed
AliasesSUSE-SU-2026:20967-1SUSE-SU-2026:20973-1SUSE-SU-2026:20997-1
Published 20-02-2026Last modified 20-02-2026

Vulnerability summary

CVE-2026-26996 is a high (CVSS 8.7) vulnerability in isaacs minimatch. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.58%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 40 · Related 25
OPENSUSE-SU-2026:11126-1OPENSUSE-SU-2026:11178-1OPENSUSE-SU-2026:20502-1OPENSUSE-SU-2026:20503-1OPENSUSE-SU-2026:20504-1OPENSUSE-SU-2026:21266-1

Timeline

  1. 20-02-2026
    PublishedVulnerability first disclosed.
  2. 20-02-2026
    Last modifiedVulnerability information updated.

Description

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.58%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

Increase +0.04 pp

From 0.53% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Minimatch

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard128 products
  • actions-runner< 2.332.0-r0
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.11< 3.11.14.3-r1
  • arangodb-3.12< 3.12.7.2-r1 | < 3.12.7.2-r2
Wolfi39 products
  • argo-workflows-ui-3.7< 3.7.13-r0 | < 3.7.10-r3
  • argo-workflows-ui-4.0< 4.0.4-r6 | < 4.0.1-r2
  • code-server< 4.106.3-r5
  • eslint< 10.0.1-r0
  • jupyter-base-notebook< 7.6.3-r2
Suse8 products
  • cockpit-packages&distro=SUSE Linux Enterprise Server 16.0< 4-160000.1.1
  • cockpit-packages&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 4-160000.1.1
  • cockpit-repos&distro=SUSE Linux Enterprise Server 16.0< 4.7-160000.2.1
  • cockpit-repos&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 4.7-160000.2.1
  • cockpit-repos&distro=SUSE Linux Micro 6.2< 4.7-160000.2.1
Opensuse3 products
  • cockpit-packages&distro=openSUSE Leap 16.0< 4-160000.1.1
  • cockpit-repos&distro=openSUSE Leap 16.0< 4.7-160000.2.1
  • cockpit-subscriptions&distro=openSUSE Leap 16.0< 12.1-160000.3.1
Debian1 product
  • node-minimatchAll versions (No fix recorded) | < 9.0.7-1
Isaacs1 product
Minimatch_project1 product
  • minimatch≥ 3.0.0, < 3.1.3 | ≥ 4.0.0, < 4.2.4 | ≥ 5.0.0, < 5.1.7 | ≥ 6.0.0, < 6.2.1 | ≥ 7.0.0, < 7.4.7 | ≥ 8.0.0, < 8.0.5 | ≥ 9.0.0, < 9.0.6 | ≥ 10.0.0, < 10.2.1
Npm1 product
  • minimatch≥ 10.0.0, < 10.2.1 | ≥ 9.0.0, < 9.0.6 | ≥ 8.0.0, < 8.0.5 | ≥ 7.0.0, < 7.4.7 | ≥ 6.0.0, < 6.2.1 | ≥ 5.0.0, < 5.1.7 | ≥ 4.0.0, < 4.2.4 | < 3.1.3
Ubuntu1 product
  • node-minimatchAll versions (No fix recorded)

9 vendors · 183 products

References

17 links
Show all 17 references