CVE-2026-26996 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
Attackers can cause denial of service in applications using minimatch by supplying glob patterns with many wildcards, triggering exponential regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26996?
CVE-2026-26996 is a high-severity denial of service vulnerability in isaacs minimatch, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
Weakness: CWE-1333
Which versions are affected by CVE-2026-26996?
16 open source packages ship an affected version, including minimatch. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
minimatch npm | All versions | 3.1.3 |
minimatch npm | All versions | 3.1.3 |
minimatch npm | From 10.0.0 | 10.2.1 |
minimatch npm | From 10.0.0 | 10.2.1 |
minimatch npm | From 4.0.0 | 4.2.4 |
minimatch npm | From 4.0.0 | 4.2.4 |
10 more packages
minimatch npm | From 5.0.0 | 5.1.7 |
minimatch npm | From 5.0.0 | 5.1.7 |
minimatch npm | From 6.0.0 | 6.2.1 |
minimatch npm | From 6.0.0 | 6.2.1 |
minimatch npm | From 7.0.0 | 7.4.7 |
minimatch npm | From 7.0.0 | 7.4.7 |
minimatch npm | From 8.0.0 | 8.0.5 |
minimatch npm | From 8.0.0 | 8.0.5 |
minimatch npm | From 9.0.0 | 9.0.6 |
minimatch npm | From 9.0.0 | 9.0.6 |
Linux distribution packages (12)
cockpit-packages SUSE:Linux Enterprise Server 16.0 | All versions | 4-160000.1.1 |
cockpit-repos SUSE:Linux Enterprise Server 16.0 | All versions | 4.7-160000.2.1 |
cockpit-subscriptions SUSE:Linux Enterprise Server 16.0 | All versions | 12.1-160000.3.1 |
cockpit-packages SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 4-160000.1.1 |
cockpit-repos SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 4.7-160000.2.1 |
cockpit-subscriptions SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 12.1-160000.3.1 |
cockpit-repos SUSE:Linux Micro 6.2 | All versions | 4.7-160000.2.1 |
cockpit-repos SUSE:Linux Micro 6.2 | All versions | 4.7-160000.2.1 |
cockpit-subscriptions SUSE:Linux Micro 6.2 | All versions | 12.1-160000.3.1 |
cockpit-packages openSUSE:Leap 16.0 | All versions | 4-160000.1.1 |
cockpit-repos openSUSE:Leap 16.0 | All versions | 4.7-160000.2.1 |
cockpit-subscriptions openSUSE:Leap 16.0 | All versions | 12.1-160000.3.1 |
Products include Minimatch Project Minimatch.
How do I fix CVE-2026-26996?
Upgrade minimatch to a fixed version for your release line: 3.1.3, 10.2.1, 4.2.4 or 5.1.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-26996 being exploited?
There is no known exploitation of CVE-2026-26996 in the wild and no public exploit code.
Other vulnerabilities in isaacs minimatch
Sources
Also known as CLEANSTART-2026-CI28358, CLEANSTART-2026-KA65824, CLEANSTART-2026-RC77081, CLSA-2026-1774570937, CLSA-2026-1774657358, DEBIAN-CVE-2026-26996 and 57 more.