CVE-2026-26996

minimatch is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits.

The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever.

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.

PoC

When minimatch compiles a glob pattern, each * becomes [^/]*? in the generated regex. For a pattern like ***************X***:

/^(?!\.)[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?X[^/]*?[^/]*?[^/]*?$/

When the test string doesn't contain X, the regex engine must try every possible way to distribute the characters across all the [^/]*? groups before concluding no match exists. With N groups and M characters, this is O(C(N+M, N)), exponential.

Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This includes:

• File search/filter UIs that accept glob patterns
• .gitignore-style filtering with user-defined rules
• Build tools that accept glob configuration
• Any API that exposes glob matching to untrusted input

Thanks to @ljharb for back-porting the fix to legacy versions of minimatch.

A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use. Typical impact: denial of service when input is crafted to trigger backtracking.

Kodem intelligence

1. What is CVE-2026-26996? CVE-2026-26996 is a high-severity inefficient regular expression (ReDoS) vulnerability in minimatch (npm), affecting versions >= 10.0.0, < 10.2.1. It is fixed in 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3. A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use.
2. Which versions of minimatch are affected by CVE-2026-26996? minimatch (npm) versions >= 10.0.0, < 10.2.1 is affected.
3. Is there a fix for CVE-2026-26996? Yes. CVE-2026-26996 is fixed in 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3. Upgrade to this version or later.
4. Is CVE-2026-26996 exploitable, and should I be worried? Whether CVE-2026-26996 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-26996 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-26996?
   • Upgrade minimatch to 10.2.1 or later
   • Upgrade minimatch to 9.0.6 or later
   • Upgrade minimatch to 8.0.5 or later
   • Upgrade minimatch to 7.4.7 or later
   • Upgrade minimatch to 6.2.1 or later
   • Upgrade minimatch to 5.1.7 or later
   • Upgrade minimatch to 4.2.4 or later
   • Upgrade minimatch to 3.1.3 or later