CVE-2026-26996: Vulnerability in minimatch Package Leading to ReDoS via Repeated Wildcards
Summary
CVE-2026-26996: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern. Affects minimatch versions < 10.2.1. Fixed in 10.2.1. How to fix ↓
Also tracked for
- minimatch · npm
The same CVE-2026-26996 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
minimatch is a popular npm package used for matching glob patterns in file paths. It is widely utilized in various applications, including build tools, file search UIs, and .gitignore-style filtering. The package allows users to define patterns for matching file names, making it a crucial component in many Node.js applications. However, it is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability when specific patterns are used, which can lead to performance degradation.
Vulnerability Detail
The vulnerability arises when a glob pattern contains multiple consecutive '' wildcards followed by a literal character that does not exist in the test string. Each '' wildcard translates to a separate regex group, leading to exponential backtracking in the V8 regex engine when a match fails. This results in a time complexity of O(4^N), where N is the number of '' characters. For instance, a pattern with 34 '' wildcards can cause the application to hang indefinitely, making it vulnerable to denial of service attacks.
How To Fix
Minimum fixed version
10.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider validating and sanitizing user inputs to prevent the use of dangerous glob patterns. Implementing strict pattern checks can help mitigate the risk of triggering the vulnerability.
Conclusion
The CVE-2026-26996 vulnerability in the minimatch package poses a significant risk of denial of service through ReDoS attacks when specific glob patterns are used. It is crucial for developers to update to the patched version and implement best practices for input validation to mitigate potential risks.
See every vulnerability recorded for minimatch →
FAQ
A ReDoS (Regular Expression Denial of Service) attack exploits the backtracking behavior of regex engines, causing them to consume excessive CPU resources and potentially crash the application.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your manifest file, such as package-lock.json, Vulert can identify if your application is affected.
Symptoms may include significant slowdowns or unresponsiveness in applications that use the minimatch package with vulnerable patterns, particularly when processing user-controlled input.
Yes, after updating to version 10.2.1 or later, the known vulnerability will be fixed, making it safe to use the minimatch package.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for minimatch.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
