CVE-2026-27904

Description

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.47%• Percentile: 40%

Techniques & Countermeasures

• CWE-1333•Inefficient Regular Expression Complexity

  The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Affected Systems

• chainguard•actions-runner

  < 2.332.0-r1

• chainguard•airflow-2

  all

• chainguard•airflow-core-2

  all

• chainguard•arangodb-3.11

  < 3.11.14.3-r2

• chainguard•arangodb-3.12

  < 3.12.7.2-r3

• chainguard•argo-workflows-ui-3.6

  < 3.6.19-r6

• chainguard•argo-workflows-ui-3.7

  < 3.7.13-r2

• chainguard•argo-workflows-ui-4.0

  < 4.0.4-r6

• chainguard•authentik-2025.12

  all

• chainguard•authentik-2026.2

  < 2026.2.4-r9

• chainguard•authentik-fips-2025.12

  all

• chainguard•authentik-fips-2026.2

  < 2026.2.4-r8

• chainguard•bash-language-server

  < 5.6.0-r4

• chainguard•code-server

  < 4.109.2-r0

• chainguard•drupal-11.3

  < 11.3.13-r1

• chainguard•emscripten

  < 5.0.2-r1

• chainguard•eslint

  < 10.0.2-r1

• chainguard•gitlab-rails-ce-18.1

  all

• chainguard•gitlab-rails-ce-18.10

  all

• chainguard•gitlab-rails-ce-18.11

  < 18.11.6-r7

• chainguard•gitlab-rails-ce-18.5

  all

• chainguard•gitlab-rails-ce-18.6

  all

• chainguard•gitlab-rails-ce-18.7

  all

• chainguard•gitlab-rails-ce-18.8

  all

• chainguard•gitlab-rails-ce-18.9

  all

• chainguard•gitlab-rails-ce-19.0

  all | < 19.0.3-r1

• chainguard•gitlab-rails-ce-19.1

  all | < 19.1.7-r6

• chainguard•gitlab-rails-ce-19.2

  all | < 19.2.5-r2

• chainguard•gitlab-rails-ce-19.3

  < 19.3.1-r6

• chainguard•gitlab-rails-ce-fips-18.1

  < 18.1.6-r15 | all

• chainguard•gitlab-rails-ce-fips-18.10

  all

• chainguard•gitlab-rails-ce-fips-18.11

  < 18.11.7-r1

• chainguard•gitlab-rails-ce-fips-18.5

  all

• chainguard•gitlab-rails-ce-fips-18.6

  all

• chainguard•gitlab-rails-ce-fips-18.7

  all

• chainguard•gitlab-rails-ce-fips-18.8

  all

• chainguard•gitlab-rails-ce-fips-18.9

  all

• chainguard•gitlab-rails-ce-fips-19.0

  all

• chainguard•gitlab-rails-ce-fips-19.1

  < 19.1.1-r1 | all | < 19.1.7-r7

• chainguard•gitlab-rails-ce-fips-19.2

  all | < 19.2.5-r2

• chainguard•gitlab-rails-ce-fips-19.3

  < 19.3.1-r3

• chainguard•graalvm-24-ce-nodejs

  all

• chainguard•graalvm-25-ce-nodejs

  < 25.0.2-r4

• chainguard•jupyter-base-notebook

  all

• chainguard•katib-earlystopping

  < 0.19.0-r23

• chainguard•katib-suggestion-goptuna-compat

  < 0.19.0-r40

• chainguard•katib-suggestion-hyperband

  < 0.19.0-r23

• chainguard•katib-suggestion-hyperopt

  < 0.19.0-r23 | < 0.19.0-r40

• chainguard•katib-suggestion-nas-darts

  < 0.19.0-r23

• chainguard•katib-suggestion-nas-enas

  < 0.19.0-r23

Showing first 50 affected entries in server-rendered view.

References (7)

• https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
• https://nvd.nist.gov/vuln/detail/CVE-2026-27904
• https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
• https://github.com/isaacs/minimatch
• https://security-tracker.debian.org/tracker/CVE-2026-27904
• https://www.suse.com/security/cve/CVE-2026-27904
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27904.json