CVE-2026-27903: minimatch DOS Vulnerability

CVE-2026-27903 Overview

CVE-2026-27903 is an Algorithmic Complexity Attack vulnerability in minimatch, a widely-used utility for converting glob expressions into JavaScript RegExp objects. Prior to the patched versions, the matchOne() function performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent ** (GLOBSTAR) segments and the input path does not match. This behavior can be exploited to cause denial of service conditions in Node.js applications.

Critical Impact

An attacker can stall the Node.js event loop for tens of seconds per invocation using a crafted glob pattern as small as 56 bytes, effectively causing denial of service without requiring authentication in many contexts.

Affected Products

• minimatch versions prior to 10.2.3
• minimatch versions prior to 9.0.7, 8.0.6, 7.4.8, 6.2.2
• minimatch versions prior to 5.1.8, 4.2.5, 3.1.3

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27903 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27903

Vulnerability Analysis

The vulnerability exists in the matchOne() function of the minimatch library. When processing glob patterns containing multiple non-adjacent ** (GLOBSTAR) segments against non-matching input paths, the function performs unbounded recursive backtracking. The time complexity of this operation follows O(C(n, k)) — binomial — where n represents the number of path segments and k represents the number of globstars in the pattern.

The practical impact is significant: with k=11 and n=30, a call to the default minimatch() API stalls for approximately 5 seconds. Increasing to k=13 causes execution to exceed 15 seconds. No memoization or call budget exists within the function to limit this exponential behavior, making it trivially exploitable for denial of service attacks.

Root Cause

The root cause is classified under CWE-407 (Inefficient Algorithmic Complexity). The matchOne() function lacks proper bounds checking and memoization when handling recursive matching of GLOBSTAR patterns. Each non-adjacent ** segment in the pattern multiplies the search space combinatorially, and without any mechanism to detect or prevent excessive recursion, the algorithm can consume CPU resources exponentially based on input characteristics.

Attack Vector

The attack vector is network-based and requires no authentication in many deployment scenarios. Realistic attack surfaces include:

• Build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup configurations)
• Multi-tenant systems where one tenant configures glob-based rules that execute in a shared process
• Admin or developer interfaces that accept ignore-rule or filter configurations as glob patterns
• CI/CD pipelines that evaluate user-submitted configuration files containing glob patterns

An attacker who can inject a crafted pattern into any of these paths can trigger the vulnerability. The attack payload is remarkably small—only 56 bytes for a 5-second stall—making it easy to embed in configuration files, form fields, or API parameters without triggering size-based validation.

The vulnerability mechanism involves constructing a glob pattern with multiple GLOBSTAR (**) segments interspersed with literal path components. When this pattern is matched against a carefully chosen non-matching path with many segments, the recursive backtracking algorithm explores an exponential number of potential matches before determining no match exists. For technical details and proof-of-concept patterns, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-27903

Indicators of Compromise

• Unusual CPU spikes in Node.js processes handling glob pattern matching
• Event loop delays or stalls in applications using minimatch
• Configuration files or API inputs containing glob patterns with multiple consecutive or non-adjacent ** segments
• User-submitted content with unusually long glob expressions

Detection Strategies

• Monitor Node.js process CPU utilization for sustained high usage without corresponding I/O activity
• Implement input validation to detect and limit the number of GLOBSTAR (**) segments in user-supplied glob patterns
• Use application performance monitoring (APM) to identify slow glob matching operations
• Review logs for repeated requests containing complex glob patterns from the same source

Monitoring Recommendations

• Set up alerting for Node.js event loop lag exceeding normal thresholds
• Implement request timeout mechanisms for operations involving user-supplied glob patterns
• Deploy SentinelOne Singularity to monitor for process resource exhaustion patterns
• Track dependency versions across your codebase to identify vulnerable minimatch installations

How to Mitigate CVE-2026-27903

Immediate Actions Required

• Update minimatch to the patched version corresponding to your major version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, or 3.1.3
• Audit your dependency tree for indirect minimatch usage (many build tools depend on minimatch)
• Implement input validation to reject or sanitize glob patterns with excessive GLOBSTAR segments
• Consider rate limiting or timeouts for endpoints that process user-supplied glob patterns

Patch Information

The minimatch maintainers have released patched versions across all supported major version branches. The fix addresses the unbounded recursion by implementing proper bounds checking and memoization in the matchOne() function.

For more information, see the GitHub Security Advisory.

Workarounds

• Validate and sanitize user-supplied glob patterns before passing them to minimatch
• Limit the number of ** segments allowed in glob patterns (recommend maximum of 2-3)
• Implement timeouts around glob matching operations to prevent indefinite blocking
• Run glob matching operations in worker threads or separate processes to isolate the event loop impact

# Update minimatch to patched version
npm update minimatch

# Or install specific patched version
npm install minimatch@10.2.3

# Check for vulnerable versions in your dependency tree
npm ls minimatch