{"answers":{"affected":"16 open source packages ship an affected version, including minimatch. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27903 exists.","fix":"Upgrade minimatch to a fixed version for your release line: 3.1.3, 10.2.3, 4.2.5 or 5.1.8.","what":"CVE-2026-27903 is a high-severity denial of service vulnerability in isaacs minimatch, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-27903 and fix it if it is affected.\n\nWhat it is: CVE-2026-27903 is a high-severity denial of service vulnerability in isaacs minimatch, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27903 exists.\n\nAffected packages and fixed versions:\n- minimatch (npm): affected all versions; fixed in 3.1.3\n- minimatch (npm): affected all versions; fixed in 3.1.3\n- minimatch (npm): affected from 10.0.0; fixed in 10.2.3\n- minimatch (npm): affected from 10.0.0; fixed in 10.2.3\n- minimatch (npm): affected from 4.0.0; fixed in 4.2.5\n- minimatch (npm): affected from 4.0.0; fixed in 4.2.5\n- minimatch (npm): affected from 5.0.0; fixed in 5.1.8\n- minimatch (npm): affected from 5.0.0; fixed in 5.1.8\n- minimatch (npm): affected from 6.0.0; fixed in 6.2.2\n- minimatch (npm): affected from 6.0.0; fixed in 6.2.2\n- minimatch (npm): affected from 7.0.0; fixed in 7.4.8\n- minimatch (npm): affected from 7.0.0; fixed in 7.4.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-27903/ (Markdown: https://insights.sbomify.com/CVE-2026-27903/index.md)","id":"CVE-2026-27903","markdown":"https://insights.sbomify.com/CVE-2026-27903/index.md","name":"CVE-2026-27903","record":{"aliases":["AZL-101105","AZL-101108","AZL-101769","CLEANSTART-2026-BZ42078","CLEANSTART-2026-KL34343","CLEANSTART-2026-TV52514","CLSA-2026-1774570924","CLSA-2026-1777250303","DEBIAN-CVE-2026-27903","ECHO-c899-4f89-0881","GHSA-7r86-cg39-jmmj","MINI-28m7-783c-xpg8","MINI-28qc-3929-mfcv","MINI-2c6j-3p3m-cmhp","MINI-2hpg-5gw8-22wj","MINI-2w5f-2wxg-6f45","MINI-44c8-7763-mwm6","MINI-5x9q-cccr-m4p4","MINI-5xgj-rqvr-q56f","MINI-6wv9-785g-w69p","MINI-7j85-6w6c-jc2h","MINI-7xc8-3cgw-qmcv","MINI-87m8-98p8-7wrj","MINI-87rp-cp3q-vjgw","MINI-8vph-f87v-cw58","MINI-94hj-wxp6-p3j7","MINI-cv69-h83x-94h7","MINI-fc93-4g6f-fx39","MINI-fhc7-cx8h-2gh8","MINI-gf5v-8664-fc2v","MINI-gvcp-vxrf-626f","MINI-hw74-423g-552r","MINI-hw96-8f4x-7gx9","MINI-j2c6-7rjq-8vrh","MINI-jjcm-9cv8-3xfv","MINI-jp75-mrpw-9x76","MINI-jq9x-3c45-x759","MINI-m7hr-rwc7-v7v7","MINI-mrx5-rm96-47jm","MINI-pc5j-4jwg-v5rx","MINI-pp2g-wvmq-5qpc","MINI-qf32-2phm-fmwr","MINI-qh43-jcmp-m3w5","MINI-r224-j68w-6m47","MINI-r9qx-42mv-59qj","MINI-rjvf-x488-9w42","MINI-rq9c-vgc3-vxcq","MINI-v35w-r6wj-fh8f","MINI-v52c-68vm-r5qg","MINI-v7rv-6pjr-7x72","MINI-vrq7-gc9m-pp9v","MINI-x3wg-m6rr-x5r7","MINI-x4q4-grrp-rr8j","MINI-x7q9-2fc7-4p9q","MINI-xv93-wh2g-3mx9","ROOT-APP-NPM-CVE-2026-27903","UBUNTU-CVE-2026-27903"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"JavaScript glob matching library","requires_auth":"none","summary":"Attackers can cause denial of service in applications using minimatch by supplying crafted glob patterns that trigger excessive backtracking.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"minimatch","vendor":"minimatch_project"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-407","name":"Inefficient Algorithmic Complexity"}],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","id":"CVE-2026-27903","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":16,"n_references":1,"next":{"headline":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","id":"CVE-2026-27904"},"packages":[{"ecosystem":"npm","fixed":["3.1.3"],"introduced":["0"],"last_affected":[],"package":"minimatch","purl":null,"source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["3.1.3"],"introduced":["0"],"last_affected":[],"package":"minimatch","purl":"pkg:npm/minimatch","source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["10.2.3"],"introduced":["10.0.0"],"last_affected":[],"package":"minimatch","purl":null,"source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["10.2.3"],"introduced":["10.0.0"],"last_affected":[],"package":"minimatch","purl":"pkg:npm/minimatch","source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["4.2.5"],"introduced":["4.0.0"],"last_affected":[],"package":"minimatch","purl":null,"source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["4.2.5"],"introduced":["4.0.0"],"last_affected":[],"package":"minimatch","purl":"pkg:npm/minimatch","source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["5.1.8"],"introduced":["5.0.0"],"last_affected":[],"package":"minimatch","purl":null,"source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["5.1.8"],"introduced":["5.0.0"],"last_affected":[],"package":"minimatch","purl":"pkg:npm/minimatch","source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["6.2.2"],"introduced":["6.0.0"],"last_affected":[],"package":"minimatch","purl":null,"source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["6.2.2"],"introduced":["6.0.0"],"last_affected":[],"package":"minimatch","purl":"pkg:npm/minimatch","source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["7.4.8"],"introduced":["7.0.0"],"last_affected":[],"package":"minimatch","purl":null,"source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["7.4.8"],"introduced":["7.0.0"],"last_affected":[],"package":"minimatch","purl":"pkg:npm/minimatch","source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["8.0.6"],"introduced":["8.0.0"],"last_affected":[],"package":"minimatch","purl":null,"source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["8.0.6"],"introduced":["8.0.0"],"last_affected":[],"package":"minimatch","purl":"pkg:npm/minimatch","source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["9.0.7"],"introduced":["9.0.0"],"last_affected":[],"package":"minimatch","purl":null,"source":"GHSA-7r86-cg39-jmmj"},{"ecosystem":"npm","fixed":["9.0.7"],"introduced":["9.0.0"],"last_affected":[],"package":"minimatch","purl":"pkg:npm/minimatch","source":"GHSA-7r86-cg39-jmmj"}],"prev":{"headline":"Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers","id":"CVE-2026-27902"},"products":["minimatch"],"published":"2026-02-26","related":[{"cvss_score":8.7,"headline":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","id":"CVE-2026-26996","kev_date_added":null,"published":"2026-02-20"},{"cvss_score":7.5,"headline":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","id":"CVE-2026-27904","kev_date_added":null,"published":"2026-02-26"},{"cvss_score":7.5,"headline":"Regular Expression Denial of Service in minimatch","id":"CVE-2016-10540","kev_date_added":null,"published":"2018-05-31"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-02-26","vendors":["isaacs"]},"summary":"Attackers can cause denial of service in applications using minimatch by supplying crafted glob patterns that trigger excessive backtracking.","url":"https://insights.sbomify.com/CVE-2026-27903/"}