isaacs minimatch up to 10.2.2 redos

Summaryinfo

A vulnerability identified as problematic has been detected in isaacs minimatch up to 10.2.2. Affected is an unknown function. The manipulation leads to redos. This vulnerability is documented as CVE-2026-27904. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in isaacs minimatch up to 10.2.2. This issue affects some unknown functionality. The manipulation with an unknown input leads to a redos vulnerability. Using CWE to declare the problem leads to CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Impacted is availability. The summary by CVE is:

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-27904 since 02/24/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 300147 (Linux Distros Unpatched Vulnerability : CVE-2026-27904), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7 or 10.2.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (300147) and CERT Bund (WID-SEC-2026-1220). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• IBM App Connect Enterprise

Productinfo

Vendor

• isaacs

Name

• minimatch

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 6.2.0
• 6.2.1
• 7.4.0
• 7.4.1
• 7.4.2
• 7.4.3
• 7.4.4
• 7.4.5
• 7.4.6
• 7.4.7
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 9.0.0
• 9.0.1
• 9.0.2
• 9.0.3
• 9.0.4
• 9.0.5
• 9.0.6
• 10.2.0
• 10.2.1
• 10.2.2

Website

• Product: https://github.com/isaacs/minimatch/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion