# CVE-2026-27903: minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments > Attackers can cause denial of service in applications using minimatch by supplying crafted glob patterns that trigger excessive backtracking. - **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 26 Feb 2026 - **Updated:** 26 Feb 2026 - **Also known as:** AZL-101105, AZL-101108, AZL-101769, CLEANSTART-2026-BZ42078, CLEANSTART-2026-KL34343, CLEANSTART-2026-TV52514, CLSA-2026-1774570924, CLSA-2026-1777250303, DEBIAN-CVE-2026-27903, ECHO-c899-4f89-0881, GHSA-7r86-cg39-jmmj, MINI-28m7-783c-xpg8, MINI-28qc-3929-mfcv, MINI-2c6j-3p3m-cmhp, MINI-2hpg-5gw8-22wj, MINI-2w5f-2wxg-6f45, MINI-44c8-7763-mwm6, MINI-5x9q-cccr-m4p4, MINI-5xgj-rqvr-q56f, MINI-6wv9-785g-w69p, MINI-7j85-6w6c-jc2h, MINI-7xc8-3cgw-qmcv, MINI-87m8-98p8-7wrj, MINI-87rp-cp3q-vjgw, MINI-8vph-f87v-cw58, MINI-94hj-wxp6-p3j7, MINI-cv69-h83x-94h7, MINI-fc93-4g6f-fx39, MINI-fhc7-cx8h-2gh8, MINI-gf5v-8664-fc2v, MINI-gvcp-vxrf-626f, MINI-hw74-423g-552r, MINI-hw96-8f4x-7gx9, MINI-j2c6-7rjq-8vrh, MINI-jjcm-9cv8-3xfv, MINI-jp75-mrpw-9x76, MINI-jq9x-3c45-x759, MINI-m7hr-rwc7-v7v7, MINI-mrx5-rm96-47jm, MINI-pc5j-4jwg-v5rx, MINI-pp2g-wvmq-5qpc, MINI-qf32-2phm-fmwr, MINI-qh43-jcmp-m3w5, MINI-r224-j68w-6m47, MINI-r9qx-42mv-59qj, MINI-rjvf-x488-9w42, MINI-rq9c-vgc3-vxcq, MINI-v35w-r6wj-fh8f, MINI-v52c-68vm-r5qg, MINI-v7rv-6pjr-7x72, MINI-vrq7-gc9m-pp9v, MINI-x3wg-m6rr-x5r7, MINI-x4q4-grrp-rr8j, MINI-x7q9-2fc7-4p9q, MINI-xv93-wh2g-3mx9, ROOT-APP-NPM-CVE-2026-27903, UBUNTU-CVE-2026-27903 ## What is CVE-2026-27903? CVE-2026-27903 is a high-severity denial of service vulnerability in isaacs minimatch, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue. Weakness: CWE-407 (Inefficient Algorithmic Complexity) ## Which versions are affected by CVE-2026-27903? 16 open source packages ship an affected version, including minimatch. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `minimatch` | npm | All versions | 3.1.3 | | `minimatch` | npm | All versions | 3.1.3 | | `minimatch` | npm | From 10.0.0 | 10.2.3 | | `minimatch` | npm | From 10.0.0 | 10.2.3 | | `minimatch` | npm | From 4.0.0 | 4.2.5 | | `minimatch` | npm | From 4.0.0 | 4.2.5 | | `minimatch` | npm | From 5.0.0 | 5.1.8 | | `minimatch` | npm | From 5.0.0 | 5.1.8 | | `minimatch` | npm | From 6.0.0 | 6.2.2 | | `minimatch` | npm | From 6.0.0 | 6.2.2 | | `minimatch` | npm | From 7.0.0 | 7.4.8 | | `minimatch` | npm | From 7.0.0 | 7.4.8 | | `minimatch` | npm | From 8.0.0 | 8.0.6 | | `minimatch` | npm | From 8.0.0 | 8.0.6 | | `minimatch` | npm | From 9.0.0 | 9.0.7 | | `minimatch` | npm | From 9.0.0 | 9.0.7 | Products: Minimatch Project Minimatch. ## How do I fix CVE-2026-27903? Upgrade minimatch to a fixed version for your release line: 3.1.3, 10.2.3, 4.2.5 or 5.1.8. ## Is CVE-2026-27903 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27903 exists. ## Other vulnerabilities in isaacs minimatch - [CVE-2026-26996](https://insights.sbomify.com/CVE-2026-26996/): minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (high 8.7) - [CVE-2026-27904](https://insights.sbomify.com/CVE-2026-27904/): minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions (high 7.5) - [CVE-2016-10540](https://insights.sbomify.com/CVE-2016-10540/): Regular Expression Denial of Service in minimatch (high 7.5) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-27903 and fix it if it is affected. What it is: CVE-2026-27903 is a high-severity denial of service vulnerability in isaacs minimatch, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27903 exists. Affected packages and fixed versions: - minimatch (npm): affected all versions; fixed in 3.1.3 - minimatch (npm): affected all versions; fixed in 3.1.3 - minimatch (npm): affected from 10.0.0; fixed in 10.2.3 - minimatch (npm): affected from 10.0.0; fixed in 10.2.3 - minimatch (npm): affected from 4.0.0; fixed in 4.2.5 - minimatch (npm): affected from 4.0.0; fixed in 4.2.5 - minimatch (npm): affected from 5.0.0; fixed in 5.1.8 - minimatch (npm): affected from 5.0.0; fixed in 5.1.8 - minimatch (npm): affected from 6.0.0; fixed in 6.2.2 - minimatch (npm): affected from 6.0.0; fixed in 6.2.2 - minimatch (npm): affected from 7.0.0; fixed in 7.4.8 - minimatch (npm): affected from 7.0.0; fixed in 7.4.8 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-27903/ (Markdown: https://insights.sbomify.com/CVE-2026-27903/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-27903 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-27903 - OSV: https://osv.dev/vulnerability/CVE-2026-27903 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-27903/ Summaries are generated and may contain mistakes; the official description above is the record.