Shell Pattern Matching Vulnerability in Node-Glob by Isaac's

CVE-2026-118773

What is CVE-2026-118773?

A vulnerability exists in the Node-Glob library that affects versions from 9.0.0 through 14.0.2. The issue arises from how glob matches files using patterns defined by the shell, manifesting primarily in abort branches within critical functions such as GlobUtil.walkCB(). When a cancellation signal is issued, subsequent operations can continue, potentially allowing malicious patterns to stack filesystem tasks and consume CPU resources. This can lead to degraded service availability, especially under repeated timed-out requests. Although there are no direct impacts on confidentiality or integrity, the vulnerability can significantly affect performance. This issue has been addressed in version 14.0.2.

References