CVE-2026-26996: Minimatch ReDoS Denial of Service Flaw

CVE-2026-26996 Overview

CVE-2026-26996 is a Regular Expression Denial of Service (ReDoS) vulnerability in minimatch, a widely-used Node.js utility for converting glob expressions into JavaScript RegExp objects. The vulnerability exists in versions 10.2.0 and below, where a maliciously crafted glob pattern containing many consecutive * wildcards followed by a literal character can cause catastrophic backtracking in V8's regex engine.

Critical Impact

Applications that pass user-controlled strings to minimatch() as the pattern argument are vulnerable to denial of service attacks with exponential time complexity O(4^N), where a single call with N=34 wildcards can hang indefinitely.

Affected Products

• minimatch versions ≤ 10.2.0 for Node.js
• Any Node.js application using vulnerable minimatch versions with user-controlled glob patterns
• Build tools, file matchers, and CLI utilities dependent on minimatch

Discovery Timeline

• 2026-02-20 - CVE CVE-2026-26996 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26996

Vulnerability Analysis

The vulnerability stems from how minimatch compiles glob patterns containing multiple consecutive * (asterisk) wildcards. When a glob pattern like ***************x is processed, each * character is individually compiled into a separate [^/]*? regex group. This creates a regex with numerous non-deterministic matching groups.

When the resulting regular expression is tested against a string that doesn't contain the literal character following the wildcards (e.g., x in this case), V8's regex engine must backtrack through all possible ways to split the input string across the wildcard groups. This results in exponential time complexity of O(4^N), where N is the number of * characters.

The practical impact is severe: with just 15 consecutive wildcards, a single minimatch() call takes approximately 2 seconds. With 34 wildcards, the function effectively hangs forever, enabling attackers to consume server resources and cause denial of service.

Root Cause

The root cause is the lack of coalescing for consecutive non-globstar * characters during regex compilation. In vulnerable versions, each individual * in a sequence generates its own regex capture group ([^/]*?), rather than recognizing that multiple consecutive wildcards are semantically equivalent to a single wildcard. This creates an exponentially complex regex pattern susceptible to catastrophic backtracking.

Attack Vector

This vulnerability is exploitable over the network in any application that accepts user-controlled input and passes it to minimatch() as the pattern argument. Common attack scenarios include:

• File search endpoints accepting glob patterns from users
• Build system configurations with user-supplied file matching patterns
• CLI tools processing user-provided glob expressions
• API endpoints that filter or match files based on client-supplied patterns

An attacker simply needs to submit a pattern with many consecutive * wildcards followed by a character not present in the target string to trigger the exponential backtracking.

The security patch introduces coalescing logic that recognizes consecutive * characters and treats them as a single wildcard, preventing the creation of multiple regex groups:

     let escaping = false
     let re = ''
     let uflag = false
+    // multiple stars that aren't globstars coalesce into one *
+    let inStar = false
     for (let i = 0; i < glob.length; i++) {
       const c = glob.charAt(i)
       if (escaping) {
         escaping = false
         re += (reSpecials.has(c) ? '\\' : '') + c
         continue
       }
+      if (c === '*') {
+        if (inStar) continue
+        inStar = true
+        re += noEmpty && /^[*]+$/.test(glob) ? starNoEmpty : star
+        hasMagic = true
+        continue
+      } else {
+        inStar = false
+      }
       if (c === '\\') {
         if (i === glob.length - 1) {
           re += '\\\\'

Source: GitHub Commit Update

Detection Methods for CVE-2026-26996

Indicators of Compromise

• Unusual CPU spikes in Node.js processes running minimatch operations
• Application timeouts or hangs during file pattern matching operations
• Request logs showing patterns with excessive consecutive * characters
• Thread pool exhaustion in applications using minimatch for glob matching

Detection Strategies

• Implement request timeout monitoring for endpoints that process glob patterns
• Add logging for glob patterns containing more than 10 consecutive * characters
• Monitor CPU utilization anomalies in services using minimatch for file matching
• Use dependency scanning tools to identify vulnerable minimatch versions in your codebase

Monitoring Recommendations

• Deploy application performance monitoring (APM) to detect regex-related CPU spikes
• Set up alerts for request latency exceeding normal thresholds on glob-processing endpoints
• Monitor for patterns of DoS attempts targeting file matching functionality
• Review access logs for suspicious patterns with repeated wildcard characters

How to Mitigate CVE-2026-26996

Immediate Actions Required

• Upgrade minimatch to version 10.2.1 or later immediately
• Audit your codebase for all minimatch usage with user-controlled input
• Implement input validation to limit the number of consecutive wildcards in user-supplied patterns
• Consider adding request timeouts to endpoints that process glob patterns

Patch Information

The vulnerability has been fixed in minimatch version 10.2.1. The fix coalesces consecutive non-globstar * characters into a single wildcard, preventing the creation of multiple regex groups that cause exponential backtracking. The patch is available via the GitHub Security Advisory GHSA-3ppc-4f35-3m26 and the security patch commit.

Workarounds

• Sanitize user input to reject or collapse consecutive * wildcards before passing to minimatch
• Implement regex timeout mechanisms at the application level
• Use alternative glob matching libraries that are not susceptible to ReDoS
• Wrap minimatch calls in try-catch with timeout logic to prevent indefinite hangs

# Update minimatch to patched version
npm update minimatch@10.2.1

# Or update via package.json
npm install minimatch@^10.2.1 --save

# Audit for vulnerable dependencies
npm audit fix