CVE-2026-27904: minimatch Catastrophic Backtracking Vulnerability in Regular Expressions

minimatch Updated 27 Feb 2026

Summary

26/02/2026

Disclosed on

CVE-2026-27904

CVE

Yes i

Fix available

High

Severity

7.5

CVSS Score

CVE-2026-27904: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions. Affects minimatch across 8 version ranges.

< 3.1.4 >= 4.0.0, < 4.2.5 >= 5.0.0, < 5.1.8 >= 6.0.0, < 6.2.2 >= 7.0.0, < 7.4.8 >= 8.0.0, < 8.0.6 >= 9.0.0, < 9.0.7 >= 10.0.0, < 10.2.3

Fixed in 8 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Also tracked for

minimatch · ghsa

The same CVE-2026-27904 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

minimatch is a popular npm package used for matching file paths against glob patterns. It is widely utilized in build tools, task runners, and CI/CD pipelines due to its ability to handle complex pattern matching. However, it is vulnerable to a specific issue where nested extglobs can lead to catastrophic backtracking, causing significant performance degradation.

Vulnerability Detail

The vulnerability arises from the way minimatch processes nested extglobs, specifically the *() and +() patterns. When these patterns are nested, they generate regular expressions with unbounded quantifiers, leading to catastrophic backtracking in the V8 JavaScript engine. This can cause the application to stall for extended periods, with measured delays exceeding 7 seconds for minimal patterns and inputs. The vulnerability can be exploited in any context where user-supplied glob patterns are processed, potentially affecting build tools and multi-tenant platforms.

How To Fix

Latest published version: 10.2.6 as of 22 Oct 2026

npm install minimatch@10.2.6

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 3.1.4 3.1.4
```
npm install minimatch@3.1.4
```
>= 4.0.0, < 4.2.5 4.2.5
```
npm install minimatch@4.2.5
```
>= 5.0.0, < 5.1.8 5.1.8
```
npm install minimatch@5.1.8
```
>= 6.0.0, < 6.2.2 6.2.2
```
npm install minimatch@6.2.2
```
>= 7.0.0, < 7.4.8 7.4.8
```
npm install minimatch@7.4.8
```
>= 8.0.0, < 8.0.6 8.0.6
```
npm install minimatch@8.0.6
```

Show all 8 release lines

>= 9.0.0, < 9.0.7 9.0.7
```
npm install minimatch@9.0.7
```
>= 10.0.0, < 10.2.3 10.2.3
```
npm install minimatch@10.2.3
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a temporary workaround, you can disable extglob processing by passing the option { noext: true } to the minimatch function. This will prevent the vulnerability from being triggered. Here is an example of how to implement this:

const { minimatch } = require('minimatch');
const pattern = '*(*(*(a|b)))';
const path = 'aaaaaaaaaaaaaaaaaaaz';
const result = minimatch(path, pattern, { noext: true });

console.log(result);

// This will execute quickly without triggering the vulnerability.

Conclusion

The minimatch package has a significant vulnerability related to catastrophic backtracking caused by nested extglobs. It is crucial for users to update to the latest patched version or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.

See every vulnerability recorded for minimatch →

FAQ

What is catastrophic backtracking?

Catastrophic backtracking occurs when a regular expression engine takes an excessive amount of time to evaluate a pattern against an input string, often due to nested quantifiers, leading to performance issues.

How can I tell if my application is affected?

You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your package-lock.json without any signup.

What are extglobs?

Extglobs are extended glob patterns that allow for more complex matching rules, such as grouping and alternation, which can be defined using symbols like *(), +(), and ?().

What is the CVSS score of this vulnerability?

The CVSS score of this vulnerability is 7.5, indicating a high severity level that requires prompt attention.

What should I do if I cannot update minimatch immediately?

If you cannot update minimatch right away, implement the workaround by using the { noext: true } option to disable extglob processing until you can apply the patch.