7.5

CVE-2026-27904: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Analyzed
AliasesUBUNTU-CVE-2026-27904DEBIAN-CVE-2026-27904CGA-239p-fjw7-2594
Published 26-02-2026Last modified 26-02-2026

Vulnerability summary

CVE-2026-27904 is a high (CVSS 7.5) vulnerability in isaacs minimatch. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.53%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 20 · Related 8
OPENSUSE-SU-2026:11126-1OPENSUSE-SU-2026:11178-1OPENSUSE-SU-2026:21266-1OPENSUSE-SU-2026:21399-1RHSA-2026:18054RHSA-2026:18055

Timeline

  1. 26-02-2026
    PublishedVulnerability first disclosed.
  2. 26-02-2026
    Last modifiedVulnerability information updated.

Description

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.53%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

Increase +0.02 pp

From 0.51% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Minimatch

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard116 products
  • actions-runner< 2.332.0-r1
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.11< 3.11.14.3-r2
  • arangodb-3.12< 3.12.7.2-r3
Wolfi34 products
  • argo-workflows-ui-3.7< 3.7.13-r2
  • argo-workflows-ui-4.0< 4.0.4-r6
  • code-server< 4.109.2-r0
  • eslint< 10.0.2-r1
  • jupyter-base-notebook< 7.6.3-r2
Opensuse3 products
  • cockpit-repos&distro=openSUSE Tumbleweed< 4.9-1.1
  • cockpit-subscriptions&distro=openSUSE Tumbleweed< 16.3-1.1
  • onnxruntime&distro=openSUSE Tumbleweed< 1.26.0-1.1
Debian1 product
  • node-minimatchAll versions (No fix recorded) | < 9.0.7-1
Isaacs1 product
  • minimatch≥ 10.0.0, < 10.2.3 | ≥ 9.0.0, < 9.0.7 | ≥ 8.0.0, < 8.0.6 | ≥ 7.0.0, < 7.4.8 | ≥ 6.0.0, < 6.2.2 | ≥ 5.0.0, < 5.1.8 | ≥ 4.0.0, < 4.2.5 | < 3.1.4
Minimatch_project1 product
  • minimatch< 3.1.4 | ≥ 4.0.0, < 4.2.5 | ≥ 5.0.0, < 5.1.8 | ≥ 6.0.0, < 6.2.2 | ≥ 7.0.0, < 7.4.8 | ≥ 8.0.0, < 8.0.6 | ≥ 9.0.0, < 9.0.7 | ≥ 10.0.0, < 10.2.3
Npm1 product
  • minimatch≥ 10.0.0, < 10.2.3 | ≥ 9.0.0, < 9.0.7 | ≥ 8.0.0, < 8.0.6 | ≥ 7.0.0, < 7.4.8 | ≥ 6.0.0, < 6.2.2 | ≥ 5.0.0, < 5.1.8 | ≥ 4.0.0, < 4.2.5 | < 3.1.4
Ubuntu1 product
  • node-minimatchAll versions (No fix recorded)

8 vendors · 158 products

References

9 links