CVE-2026-26996 in minimatch
Summary
by MITRE • 02/20/2026
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/22/2026
The vulnerability described in CVE-2026-26996 represents a critical Regular Expression Denial of Service (ReDoS) flaw within the minimatch library, a widely used utility for converting glob expressions into JavaScript regular expressions. This library serves as a fundamental component in many Node.js applications, particularly those involving file system operations, pattern matching, and configuration management. The vulnerability specifically manifests when processing glob patterns containing multiple consecutive asterisk wildcards followed by a literal character that does not appear in the test string, creating a scenario where the regular expression engine becomes extremely inefficient during pattern matching operations.
The technical root cause of this vulnerability lies in how minimatch translates glob patterns into regular expressions, particularly when handling multiple consecutive wildcard characters. Each asterisk in the pattern gets compiled into a separate [^/]*? regex group, which represents a non-greedy match for any character except forward slashes. When the regex engine attempts to match these patterns against strings that don't contain the trailing literal character, V8's JavaScript engine experiences exponential backtracking across all possible ways to split the string among the multiple regex groups. This backtracking behavior creates a combinatorial explosion in execution time, with the time complexity growing at O(4^N) where N represents the number of consecutive asterisks. The mathematical progression demonstrates that even modest increases in wildcard count result in dramatically longer processing times, making this vulnerability particularly dangerous in production environments.
The operational impact of this vulnerability extends far beyond simple performance degradation, presenting a genuine denial of service threat to applications that rely on user input for pattern matching operations. Any application that accepts user-controlled strings and passes them directly to minimatch() as pattern arguments becomes vulnerable to this attack vector, potentially allowing malicious actors to craft specially designed glob patterns that can cause applications to hang or become unresponsive for extended periods. The severity increases exponentially with the number of wildcards, making a simple pattern with 34 consecutive asterisks capable of effectively hanging the application indefinitely. This vulnerability directly aligns with CWE-400, which categorizes Regular Expression Denial of Service attacks, and represents a classic example of how seemingly harmless input processing can become a critical security risk when not properly validated or constrained.
Mitigation strategies for this vulnerability should focus on both immediate remediation and long-term architectural improvements to prevent similar issues. The primary fix involves upgrading to minimatch version 10.2.1 or later, which implements proper input validation and pattern normalization to prevent exponential backtracking scenarios. Organizations should also implement input sanitization measures that limit the complexity of glob patterns accepted from users, particularly by establishing maximum allowable wildcard counts or implementing pattern length restrictions. Additionally, applications should employ timeout mechanisms around pattern matching operations to prevent indefinite hanging, and consider implementing rate limiting for pattern matching requests to reduce the effectiveness of potential DoS attacks. This vulnerability underscores the importance of following security best practices such as those outlined in the OWASP Top Ten and ATT&CK framework's T1496 technique for Resource Exhaustion, emphasizing that even common utility libraries can present critical security risks when not properly secured against malicious input patterns.