CVE-2026-118773 in node-glob
Summary
by MITRE • 10/29/2026
Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified involves the glob library's handling of abort signals during file system traversal operations, specifically affecting versions from 9.0.0 through 14.0.2. The core technical flaw resides within the source code module walker.ts, where functions such as GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync() fail to properly terminate execution upon receiving an abort signal. In a correctly implemented asynchronous cancellation pattern, these callback-invoking methods should return immediately after detecting that the associated AbortSignal has been aborted or rejected. However, due to this implementation defect, control flow continues into subsequent processing stages including processor.processPatterns(), readdirCB(), and recursive directory traversal logic even after the caller has signaled for termination. This behavior contradicts standard expectations for resource management in asynchronous JavaScript environments where cancellation is intended to serve as a mechanism for bounding computational effort or preventing long-running operations from consuming excessive resources.
The operational impact of this flaw manifests primarily through denial-of-service conditions rather than data confidentiality or integrity breaches. When applications utilize glob() or globStream() functions and expose attacker-influenced file patterns or directory structures, they may rely on cancellation mechanisms to limit the scope of filesystem access. If an application sets a timeout using AbortSignal.timeout() or manually aborts a signal expecting immediate cessation of work, the library continues executing background filesystem operations and CPU-intensive pattern matching tasks. This results in the accumulation of pending asynchronous operations that do not terminate as expected. Over time, repeated timed-out requests can lead to resource exhaustion on the server side, degrading worker throughput and potentially causing service unavailability for other processes sharing the same runtime environment or system resources. The lack of proper cleanup means that memory usage and CPU cycles continue to be consumed by orphaned traversal tasks, creating a persistent performance degradation vector.
From a classification perspective, this vulnerability aligns with CWE-400: Uncontrolled Resource Consumption, as the application fails to limit the amount of computational resources used during file system operations. It also relates to CWE-756: Missing Custom Error Handling or Incorrectly Handled Exceptional Condition, specifically in how abort signals are treated as non-fatal events that allow execution to proceed rather than halting the operation. In terms of attack vectors and tactics, this flaw can be leveraged within the MITRE ATT&CK framework under T1496: Resource Hijacking or potentially T1053: Scheduled Task/Job if the lingering processes interfere with system stability over time. Attackers who have any degree of influence over input patterns or directory structures targeted by glob operations can trigger this condition repeatedly to exhaust server resources, effectively performing a resource exhaustion attack without needing to exploit traditional injection or code execution flaws.
Mitigation strategies for organizations relying on affected versions include upgrading the glob library to version 14.0.2 or later where the issue has been resolved. For environments unable to upgrade immediately, developers should implement additional safeguards by wrapping glob calls in try-catch blocks that explicitly handle abort signals and ensure cleanup procedures are triggered manually if necessary. It is also advisable to review application logic for any reliance on cancellation as a primary resource control mechanism and instead enforce strict limits on recursion depth or file count before initiating traversal operations. Monitoring tools should be configured to detect abnormal spikes in CPU usage or memory consumption associated with filesystem access patterns, which may indicate active exploitation of this vulnerability. Ensuring that external inputs are validated against allowed directories and pattern constraints further reduces the attack surface available for triggering these uncontrolled resource consumptions.