isaacs minimatch up to 10.2.0 Pattern redos

Summaryinfo

A vulnerability classified as problematic has been found in isaacs minimatch up to 10.2.0. Affected by this issue is the function minimatch. Performing a manipulation of the argument Pattern results in redos. This vulnerability was named CVE-2026-26996. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in isaacs minimatch up to 10.2.0. It has been classified as problematic. This affects the function minimatch. The manipulation of the argument pattern with an unknown input leads to a redos vulnerability. CWE is classifying the issue as CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. This is going to have an impact on availability. The summary by CVE is:

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-26996 since 02/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1449.003 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 299696 (Linux Distros Unpatched Vulnerability : CVE-2026-26996), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 10.2.1 eliminates this vulnerability. Applying the patch 2e111f3a79abc00fa73110195de2c0f2351904f5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (299696). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• isaacs

Name

• minimatch

Version

• 10.0
• 10.1
• 10.2.0

License

• open-source

Website

• Product: https://github.com/isaacs/minimatch/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion