[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-27904":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T00:21:03.480Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":24,"aliases":34,"duplicate_of":9,"upstream":36,"downstream":37,"duplicates":78,"related":79,"reserved_at":9,"published_at":87,"modified_at":88,"state":89,"summary":90,"references_raw":98,"kevs":123,"epss":124,"epss_history":127,"metrics":402,"affected":412},"CVE-2026-27904","minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-1333","Inefficient Regular Expression Complexity","The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.","weakness","Draft","Base","High",[20],{"id":21,"name":22,"techniques":23},"CAPEC-492","Regular Expression Exponential Blowup",[],[25],{"_key":26,"name":27,"source":28,"url":29,"maturity":30,"reliability_score":31,"verified":32,"type":9,"platforms":33,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_ISAACS_MINIMATCH","Minimatch","github","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","poc",0.3,false,[],[35],"GHSA-23c5-xmqv-rm74",[],[38,40,42,44,46,48,50,52,54,56,58,60,62,64,66,68,70,72,74,76],{"_key":39},"UBUNTU-CVE-2026-27904",{"_key":41},"SUSE-SU-2026:2363-1",{"_key":43},"DEBIAN-CVE-2026-27904",{"_key":45},"OPENSUSE-SU-2026:11126-1",{"_key":47},"OPENSUSE-SU-2026:11146-1",{"_key":49},"OPENSUSE-SU-2026:11178-1",{"_key":51},"OPENSUSE-SU-2026:21266-1",{"_key":53},"RHSA-2026:18054",{"_key":55},"RHSA-2026:18055",{"_key":57},"RHSA-2026:24761",{"_key":59},"RHSA-2026:6277",{"_key":61},"RHSA-2026:7080",{"_key":63},"RHSA-2026:7123",{"_key":65},"RHSA-2026:7302",{"_key":67},"RHSA-2026:7310",{"_key":69},"RHSA-2026:7896",{"_key":71},"RHSA-2026:7983",{"_key":73},"RHSA-2026:8339",{"_key":75},"RHSA-2026:9711",{"_key":77},"RHSA-2026:9874",[],[80,81,82,83,84,85],{"_key":41},{"_key":45},{"_key":47},{"_key":49},{"_key":51},{"_key":86},"CGA-G4JG-35CV-GFX5","2026-02-26T01:07:42.693Z","2026-02-26T19:21:39.006Z","Analyzed",{"cisa_kev":32,"cisa_ransomware":32,"cisa_vendor":9,"epss_severity":91,"epss_score":92,"severity":93,"severity_score":94,"severity_version":95,"severity_source":96,"severity_vector":97,"severity_status":89},"low",0.00472,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",[99,109,114,118],{"url":100,"sources":101,"tags":104},"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",[96,102,103],"nvd","osv_npm",[105,106,107,108],"X Refsource CONFIRM","Exploit","Vendor Advisory","WEB",{"url":110,"sources":111,"tags":112},"https://nvd.nist.gov/vuln/detail/CVE-2026-27904",[103],[113],"Advisory",{"url":115,"sources":116,"tags":117},"https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce",[103],[108],{"url":119,"sources":120,"tags":121},"https://github.com/isaacs/minimatch",[103],[122],"PACKAGE",[],{"date":125,"score":92,"percentile":126},"2026-07-05",0.37463,[128,132,135,138,141,144,147,151,154,157,160,163,166,169,172,175,178,181,184,187,190,193,196,199,203,206,209,212,215,218,221,224,227,231,234,237,240,243,246,249,251,254,257,261,264,267,270,273,276,279,282,285,288,291,294,297,300,303,306,309,312,315,318,321,324,327,330,333,336,340,343,346,349,352,355,358,361,364,367,370,373,376,378,381,384,387,390,393,396,399],{"date":129,"score":130,"percentile":131},"2026-02-26",0.0004,0.11966,{"date":133,"score":130,"percentile":134},"2026-02-27",0.11978,{"date":136,"score":130,"percentile":137},"2026-02-28",0.11943,{"date":139,"score":130,"percentile":140},"2026-03-01",0.11958,{"date":142,"score":130,"percentile":143},"2026-03-02",0.11903,{"date":145,"score":130,"percentile":146},"2026-03-03",0.11886,{"date":148,"score":149,"percentile":150},"2026-03-04",0.00052,0.16083,{"date":152,"score":149,"percentile":153},"2026-03-05",0.16105,{"date":155,"score":149,"percentile":156},"2026-03-06",0.16102,{"date":158,"score":149,"percentile":159},"2026-03-07",0.16104,{"date":161,"score":149,"percentile":162},"2026-03-08",0.16069,{"date":164,"score":149,"percentile":165},"2026-03-09",0.16037,{"date":167,"score":149,"percentile":168},"2026-03-10",0.16028,{"date":170,"score":149,"percentile":171},"2026-03-11",0.16052,{"date":173,"score":149,"percentile":174},"2026-03-12",0.16114,{"date":176,"score":149,"percentile":177},"2026-03-13",0.16143,{"date":179,"score":149,"percentile":180},"2026-03-14",0.16147,{"date":182,"score":149,"percentile":183},"2026-03-15",0.16084,{"date":185,"score":149,"percentile":186},"2026-03-16",0.16048,{"date":188,"score":149,"percentile":189},"2026-03-17",0.16025,{"date":191,"score":149,"percentile":192},"2026-03-18",0.16035,{"date":194,"score":149,"percentile":195},"2026-03-19",0.16054,{"date":197,"score":149,"percentile":198},"2026-03-20",0.16118,{"date":200,"score":201,"percentile":202},"2026-03-21",0.00017,0.03976,{"date":204,"score":201,"percentile":205},"2026-03-22",0.03968,{"date":207,"score":201,"percentile":208},"2026-03-23",0.03967,{"date":210,"score":201,"percentile":211},"2026-03-24",0.03955,{"date":213,"score":201,"percentile":214},"2026-03-25",0.03979,{"date":216,"score":201,"percentile":217},"2026-03-26",0.03981,{"date":219,"score":201,"percentile":220},"2026-03-27",0.03999,{"date":222,"score":201,"percentile":223},"2026-03-28",0.04004,{"date":225,"score":201,"percentile":226},"2026-03-29",0.03996,{"date":228,"score":229,"percentile":230},"2026-03-30",0.00018,0.04639,{"date":232,"score":229,"percentile":233},"2026-03-31",0.04615,{"date":235,"score":229,"percentile":236},"2026-04-01",0.04633,{"date":238,"score":229,"percentile":239},"2026-04-02",0.04695,{"date":241,"score":229,"percentile":242},"2026-04-03",0.04708,{"date":244,"score":229,"percentile":245},"2026-04-04",0.04707,{"date":247,"score":229,"percentile":248},"2026-04-05",0.04703,{"date":250,"score":229,"percentile":242},"2026-04-06",{"date":252,"score":229,"percentile":253},"2026-04-07",0.04722,{"date":255,"score":229,"percentile":256},"2026-04-08",0.04755,{"date":258,"score":259,"percentile":260},"2026-04-09",0.00025,0.06831,{"date":262,"score":259,"percentile":263},"2026-04-10",0.06846,{"date":265,"score":259,"percentile":266},"2026-04-11",0.06835,{"date":268,"score":259,"percentile":269},"2026-04-12",0.06829,{"date":271,"score":259,"percentile":272},"2026-04-13",0.06822,{"date":274,"score":259,"percentile":275},"2026-04-14",0.06739,{"date":277,"score":259,"percentile":278},"2026-04-15",0.0676,{"date":280,"score":259,"percentile":281},"2026-04-16",0.06764,{"date":283,"score":259,"percentile":284},"2026-04-17",0.06773,{"date":286,"score":259,"percentile":287},"2026-04-18",0.06755,{"date":289,"score":259,"percentile":290},"2026-04-19",0.06725,{"date":292,"score":259,"percentile":293},"2026-04-20",0.06707,{"date":295,"score":259,"percentile":296},"2026-04-21",0.06899,{"date":298,"score":259,"percentile":299},"2026-04-22",0.06896,{"date":301,"score":259,"percentile":302},"2026-04-23",0.06927,{"date":304,"score":259,"percentile":305},"2026-04-24",0.06884,{"date":307,"score":259,"percentile":308},"2026-04-25",0.06916,{"date":310,"score":259,"percentile":311},"2026-04-26",0.06906,{"date":313,"score":259,"percentile":314},"2026-04-27",0.06895,{"date":316,"score":259,"percentile":317},"2026-04-28",0.06868,{"date":319,"score":259,"percentile":320},"2026-04-29",0.06879,{"date":322,"score":259,"percentile":323},"2026-04-30",0.0689,{"date":325,"score":259,"percentile":326},"2026-05-01",0.06883,{"date":328,"score":259,"percentile":329},"2026-05-02",0.06934,{"date":331,"score":259,"percentile":332},"2026-05-03",0.06922,{"date":334,"score":259,"percentile":335},"2026-05-04",0.06905,{"date":337,"score":338,"percentile":339},"2026-05-05",0.00026,0.07214,{"date":341,"score":338,"percentile":342},"2026-05-06",0.07239,{"date":344,"score":338,"percentile":345},"2026-05-07",0.07369,{"date":347,"score":338,"percentile":348},"2026-05-08",0.07387,{"date":350,"score":338,"percentile":351},"2026-05-09",0.0744,{"date":353,"score":338,"percentile":354},"2026-05-10",0.07443,{"date":356,"score":338,"percentile":357},"2026-05-11",0.07424,{"date":359,"score":338,"percentile":360},"2026-05-12",0.07439,{"date":362,"score":338,"percentile":363},"2026-05-13",0.07442,{"date":365,"score":338,"percentile":366},"2026-05-14",0.07474,{"date":368,"score":338,"percentile":369},"2026-05-15",0.07473,{"date":371,"score":338,"percentile":372},"2026-05-16",0.07491,{"date":374,"score":338,"percentile":375},"2026-05-17",0.07482,{"date":377,"score":338,"percentile":351},"2026-05-18",{"date":379,"score":338,"percentile":380},"2026-05-19",0.07411,{"date":382,"score":338,"percentile":383},"2026-05-20",0.074,{"date":385,"score":338,"percentile":386},"2026-05-21",0.07396,{"date":388,"score":338,"percentile":389},"2026-05-22",0.0769,{"date":391,"score":338,"percentile":392},"2026-05-23",0.07692,{"date":394,"score":338,"percentile":395},"2026-05-24",0.07697,{"date":397,"score":338,"percentile":398},"2026-05-25",0.07682,{"date":400,"score":338,"percentile":401},"2026-05-26",0.07667,[403,408,410],{"source":96,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":404,"cvss_v4_0":9},{"baseScore":94,"baseSeverity":405,"vectorString":97,"impactScore":406,"exploitabilityScore":407},"HIGH",6,10,{"source":102,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":409,"cvss_v4_0":9},{"baseScore":94,"baseSeverity":405,"vectorString":97,"impactScore":406,"exploitabilityScore":407},{"source":103,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":411,"cvss_v4_0":9},{"baseScore":94,"baseSeverity":9,"vectorString":97,"impactScore":406,"exploitabilityScore":407},[413,452,472],{"ecosystem":9,"name":414,"vendor":415,"product":414,"cpe_part":416,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":417},"minimatch","isaacs","a",[418,425,429,433,437,441,445,449],{"version":419,"is_range":420,"range_type":96,"version_start":421,"version_start_type":422,"version_end":423,"version_end_type":424,"fixed_in":9},">= 10.0.0, \u003C 10.2.3",true,"10.0.0","including","10.2.3","excluding",{"version":426,"is_range":420,"range_type":96,"version_start":427,"version_start_type":422,"version_end":428,"version_end_type":424,"fixed_in":9},">= 9.0.0, \u003C 9.0.7","9.0.0","9.0.7",{"version":430,"is_range":420,"range_type":96,"version_start":431,"version_start_type":422,"version_end":432,"version_end_type":424,"fixed_in":9},">= 8.0.0, \u003C 8.0.6","8.0.0","8.0.6",{"version":434,"is_range":420,"range_type":96,"version_start":435,"version_start_type":422,"version_end":436,"version_end_type":424,"fixed_in":9},">= 7.0.0, \u003C 7.4.8","7.0.0","7.4.8",{"version":438,"is_range":420,"range_type":96,"version_start":439,"version_start_type":422,"version_end":440,"version_end_type":424,"fixed_in":9},">= 6.0.0, \u003C 6.2.2","6.0.0","6.2.2",{"version":442,"is_range":420,"range_type":96,"version_start":443,"version_start_type":422,"version_end":444,"version_end_type":424,"fixed_in":9},">= 5.0.0, \u003C 5.1.8","5.0.0","5.1.8",{"version":446,"is_range":420,"range_type":96,"version_start":447,"version_start_type":422,"version_end":448,"version_end_type":424,"fixed_in":9},">= 4.0.0, \u003C 4.2.5","4.0.0","4.2.5",{"version":450,"is_range":420,"range_type":96,"version_start":9,"version_start_type":9,"version_end":451,"version_end_type":424,"fixed_in":9},"\u003C 3.1.4","3.1.4",{"ecosystem":9,"name":414,"vendor":453,"product":414,"cpe_part":416,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":454},"minimatch_project",[455,458,460,462,464,466,468,470],{"version":456,"is_range":420,"range_type":457,"version_start":9,"version_start_type":9,"version_end":451,"version_end_type":424,"fixed_in":9},"lt3.1.4","cpe",{"version":459,"is_range":420,"range_type":457,"version_start":447,"version_start_type":422,"version_end":448,"version_end_type":424,"fixed_in":9},"gte4.0.0_lt4.2.5",{"version":461,"is_range":420,"range_type":457,"version_start":443,"version_start_type":422,"version_end":444,"version_end_type":424,"fixed_in":9},"gte5.0.0_lt5.1.8",{"version":463,"is_range":420,"range_type":457,"version_start":439,"version_start_type":422,"version_end":440,"version_end_type":424,"fixed_in":9},"gte6.0.0_lt6.2.2",{"version":465,"is_range":420,"range_type":457,"version_start":435,"version_start_type":422,"version_end":436,"version_end_type":424,"fixed_in":9},"gte7.0.0_lt7.4.8",{"version":467,"is_range":420,"range_type":457,"version_start":431,"version_start_type":422,"version_end":432,"version_end_type":424,"fixed_in":9},"gte8.0.0_lt8.0.6",{"version":469,"is_range":420,"range_type":457,"version_start":427,"version_start_type":422,"version_end":428,"version_end_type":424,"fixed_in":9},"gte9.0.0_lt9.0.7",{"version":471,"is_range":420,"range_type":457,"version_start":421,"version_start_type":422,"version_end":423,"version_end_type":424,"fixed_in":9},"gte10.0.0_lt10.2.3",{"ecosystem":473,"name":414,"vendor":473,"product":414,"cpe_part":9,"purl_type":474,"purl_namespace":9,"purl_name":414,"source":9,"versions":475},"Npm","npm",[476,479,481,483,485,487,489,491],{"version":477,"is_range":420,"range_type":478,"version_start":421,"version_start_type":422,"version_end":423,"version_end_type":424,"fixed_in":9},"gte10_0_0_lt10_2_3","semver",{"version":480,"is_range":420,"range_type":478,"version_start":427,"version_start_type":422,"version_end":428,"version_end_type":424,"fixed_in":9},"gte9_0_0_lt9_0_7",{"version":482,"is_range":420,"range_type":478,"version_start":431,"version_start_type":422,"version_end":432,"version_end_type":424,"fixed_in":9},"gte8_0_0_lt8_0_6",{"version":484,"is_range":420,"range_type":478,"version_start":435,"version_start_type":422,"version_end":436,"version_end_type":424,"fixed_in":9},"gte7_0_0_lt7_4_8",{"version":486,"is_range":420,"range_type":478,"version_start":439,"version_start_type":422,"version_end":440,"version_end_type":424,"fixed_in":9},"gte6_0_0_lt6_2_2",{"version":488,"is_range":420,"range_type":478,"version_start":443,"version_start_type":422,"version_end":444,"version_end_type":424,"fixed_in":9},"gte5_0_0_lt5_1_8",{"version":490,"is_range":420,"range_type":478,"version_start":447,"version_start_type":422,"version_end":448,"version_end_type":424,"fixed_in":9},"gte4_0_0_lt4_2_5",{"version":492,"is_range":420,"range_type":478,"version_start":9,"version_start_type":9,"version_end":451,"version_end_type":424,"fixed_in":9},"lt3_1_4"]