Regular Expression Denial of Service Vulnerability in Minimatch by Issacs
CVE-2026-26996

8.7HIGH

Key Information:

Vendor

Isaacs

Status
Minimatch
Vendor
CVE Published:
20 February 2026

What is CVE-2026-26996?

Minimatch, a minimal matching utility for glob expressions in JavaScript, is susceptible to a Regular Expression Denial of Service (ReDoS) attack in versions 10.2.0 and earlier. The vulnerability emerges when the glob pattern includes numerous consecutive '' wildcards preceding a literal character absent in the test string. This design causes V8's regex engine to backtrack exponentially, creating a time complexity of O(4^N), where N represents the '' characters. For instance, when N reaches 15, the minimatch() function may take approximately 2 seconds to execute, and with N at 34, it effectively hangs indefinitely. Applications that process user-controlled strings via minimatch() as the pattern parameter are at risk. This issue has been addressed in version 10.2.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

minimatch < 10.2.1

References

https://github.com/isaacs/minimatch/security/advisories/G...
x_refsource_CONFIRM
https://github.com/isaacs/minimatch/commit/2e111f3a79abc0...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.