Skip to content
Fencer Vulns
high 7.5

CVE-2026-26996 json

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

published 2026-02-18 8 mo ago modified 2026-09-10 1 mo ago also GHSA-3ppc-4f35-3m26 , EUVD-2026-8032

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Patch / fix

  • npm minimatch 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7, 8.0.5, 9.0.6, 10.2.1
  • minimatch_project minimatch 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7, 8.0.5, 9.0.6, 10.2.1
  • node-minimatch Debian 14 9.0.7-1

debian advisories DEBIAN-CVE-2026-26996

  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.5-1.el8ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.5-1.el9ap
  • python3.12-click ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 8.3.3-1.el8ap
  • python3.12-click ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 8.3.3-1.el9ap
  • python3.12-pillow ansible automation platform 2.5 12.2.0-1.el8ap
  • python3.12-pillow ansible automation platform 2.5 12.2.0-1.el9ap
  • python3.12-cryptography ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 46.0.7-1.el8ap
  • python3.12-cryptography ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 46.0.7-1.el9ap

red hat advisories RHSA-2026:24761RHSA-2026:18054RHSA-2026:18055RHSA-2026:13508RHSA-2026:9874RHSA-2026:9711

  • cockpit-subscriptions SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 16.2-160000.1.1
  • cockpit SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 364-160000.1.1
  • cockpit-repos SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.8-160000.1.1
  • cockpit-podman SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 128-160000.1.1
  • cockpit-machines SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 354-160000.1.1
  • cockpit-packages SLES for SAP applications 16.0, SLES 16.0 5-160000.1.1
  • cockpit-machines Linux Micro 6.0 305-4.1
  • cockpit-tukit Linux Micro 6.0 0.1.2~git0.647b3e3-2.1

suse advisories SUSE-SU-2026:22770-1SUSE-SU-2026:22837-1SUSE-SU-2026:21246-1SUSE-SU-2026:21245-1SUSE-SU-2026:21256-1SUSE-SU-2026:21253-1

  • cockpit-subscriptions openSUSE Leap 16.0 16.2-160000.1.1
  • cockpit openSUSE Leap 16.0 364-160000.1.1
  • cockpit-repos openSUSE Leap 16.0 4.8-160000.1.1
  • cockpit-podman openSUSE Leap 16.0 128-160000.1.1
  • cockpit-machines openSUSE Leap 16.0 354-160000.1.1
  • cockpit-packages openSUSE Leap 16.0 5-160000.1.1
  • os-autoinst openSUSE Leap 16.0 5.1783082953.c3cb41d-bp160.1.1
  • openQA openSUSE Leap 16.0 5.1783076943.6691832d-bp160.1.1

opensuse advisories openSUSE-SU-2026:21399-1openSUSE-SU-2026:21266-1openSUSE-SU-2026:11178-1openSUSE-SU-2026:11126-1openSUSE-SU-2026:20532-1openSUSE-SU-2026:20504-1

  • npm AlmaLinux 8 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda
  • nodejs AlmaLinux 8 1:20.20.2-1.module_el8.10.0+4165+3f200bda
  • nodejs-nodemon AlmaLinux 8 3.0.1-1.module_el8.10.0+3982+85c136aa
  • nodejs-full-i18n AlmaLinux 8 1:20.20.2-1.module_el8.10.0+4165+3f200bda
  • nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4165+3f200bda
  • nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4165+3f200bda
  • npm AlmaLinux 8 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
  • nodejs AlmaLinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42

almalinux advisories ALSA-2026:8339ALSA-2026:7670ALSA-2026:7675ALSA-2026:7896ALSA-2026:7350ALSA-2026:7123

  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1924+614dc87f
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1935+d3cbe60f
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1666+930e28e8
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1667+4a788d89
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1989+e60144d9
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1988+437f3d23
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.9.0+1760+903d54b9
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1823+b5789597

rocky linux advisories RLSA-2026:8339RLSA-2026:7675RLSA-2026:7896RLSA-2026:7670RLSA-2026:7080RLSA-2026:7350

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-26996 updated cvss 6.5

minimatch: minimatch: Denial of Service via specially crafted glob patterns

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8, openshift-logging/logging-view-plugin-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8
    affected: no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat 3scale API Management Platform 2 3scale-amp20/system, 3scale-amp21/system, 3scale-amp22/system, 3scale-amp24/system, 3scale-amp25/system, 3scale-amp26/system, +3 more Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat Enterprise Linux 8 js-uglify, uglify-js
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 10 nodejs-nodemon
    affected: no fix available
  • Red Hat Fuse 7 io.hawt-project, io.apicurio-apicurito, io.hawt-hawtio-online, io.syndesis-syndesis-parent Red Hat JBoss Enterprise Application Platform 7 io.hawt-project, org.jboss.hal-hal-parent
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 8 org.jboss.hal-hal-parent, org.keycloak-keycloak-parent
    affected: no fix available
  • Red Hat JBoss Enterprise Application Platform Expansion Pack io.hawt-project, org.jboss.hal-hal-parent, org.keycloak-keycloak-parent
    affected: no fix planned “Will not fix”
show 27 more
  • Red Hat OpenShift Dev Spaces devspaces/machineexec-rhel9 Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel8
    affected: no fix available
  • Red Hat Single Sign-On 7 org.keycloak-keycloak-parent
    affected: no fix planned “Will not fix”
  • Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: no fix available
  • Red Hat streams for Apache Kafka 3 com.github.streamshub-console
    affected: no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260422-3.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260422-3.el9ap
    fixed: vendor fix RHSA-2026:24761
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.8-1.el9ap
    fixed: vendor fix RHSA-2026:13508
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Developer Hub 1.8 rhdh 1776784286
    fixed: vendor fix RHSA-2026:9742
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 20.20.2-1.module+el8.10.0+24197+1602b452, nodejs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-libs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs-libs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-nodemon 3.0.1-1.module+el8.10.0+23521+490ebfde, +14 more
    fixed: vendor fix RHSA-2026:8339
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 20.20.2-1.module+el9.7.0+24193+41b7b572, nodejs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-libs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs-libs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-nodemon 3.0.1-1.module+el9.7.0+24157+8ddb2461, +14 more
    fixed: vendor fix RHSA-2026:7896
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.22.2-1.el10_1, nodejs22 22.22.2-1.el10_1, nodejs24 24.14.1-2.el10_1, nodejs-libs 22.22.2-1.el10_1, nodejs24-libs 24.14.1-2.el10_1, nodejs-full-i18n 22.22.2-1.el10_1, +3 more
    fixed: vendor fix RHSA-2026:7080
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs 22.22.2-2.el10_0, nodejs22 22.22.2-2.el10_0, nodejs-libs 22.22.2-2.el10_0, nodejs-full-i18n 22.22.2-2.el10_0, nodejs-npm 10.9.7-1.22.22.2.2.el10_0
    fixed: vendor fix RHSA-2026:7310
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) nodejs 20.20.2-2.module+el9.4.0+24216+64c58546, npm 10.8.2-1.20.20.2.2.module+el9.4.0+24216+64c58546, nodejs-nodemon 3.0.1-1.module+el9.3.0.z+20478+84a9f781, nodejs-full-i18n 20.20.2-2.module+el9.4.0+24216+64c58546, nodejs-packaging 2021.06-4.module+el9.3.0+19518+63aad52d, nodejs-packaging-bundler 2021.06-4.module+el9.3.0+19518+63aad52d
    fixed: vendor fix RHSA-2026:9711
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 20.20.2-2.module+el9.6.0+24220+c44c288d, nodejs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-libs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-nodemon 3.0.1-1.module+el9.6.0+23146+be9976bd, nodejs-nodemon 3.0.1-1.module+el9.6.0+23473+45664c2d, npm 10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d, +7 more
    fixed: vendor fix RHSA-2026:9874
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-wildfly 8.1.6-5.GA_redhat_00007.1.el8eap, eap8-wildfly-modules 8.1.6-5.GA_redhat_00007.1.el8eap, eap8-wildfly-java-jdk17 8.1.6-5.GA_redhat_00007.1.el8eap, eap8-wildfly-java-jdk21 8.1.6-5.GA_redhat_00007.1.el8eap
    fixed: vendor fix RHSA-2026:18054
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA hal-console 3.7.19.Final-redhat-00001
    fixed: vendor fix RHSA-2026:18059
  • Red Hat Migration Toolkit for Applications 8.1 mta/mta-ui-rhel9 1785169013
    fixed: vendor fix RHSA-2026:50300
  • Red Hat OpenShift AI 2.25 rhoai 1776257621, rhoai 1776319193, rhoai 1776319213, rhoai 1776319275, rhoai 1776336652, rhoai 1776413275, +6 more
    fixed: vendor fix RHSA-2026:10184
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-console 1791245342
    fixed: vendor fix RHSA-2026:77316
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-console 1791299243
    fixed: vendor fix RHSA-2026:77321
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-console 1787056403
    fixed: vendor fix RHSA-2026:56789
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-console 1787028559
    fixed: vendor fix RHSA-2026:56912
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-console-rhel9 1783306715
    fixed: vendor fix RHSA-2026:36621
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-console-rhel9 1784803344
    fixed: vendor fix RHSA-2026:47728
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-console-rhel9 1783453136
    fixed: vendor fix RHSA-2026:37192
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-console-rhel9 1780365421
    fixed: vendor fix RHSA-2026:23246
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-console-rhel9 1779874396
    fixed: vendor fix RHSA-2026:21703

14 more fixed, 55 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm minimatch
>=10.0.0, <10.2.1
>=9.0.0, <9.0.6
>=8.0.0, <8.0.5
>=7.0.0, <7.4.7
>=6.0.0, <6.2.1
>=5.0.0, <5.1.7
>=4.0.0, <4.2.4
<3.1.3
10.2.1
9.0.6
8.0.5
7.4.7
6.2.1
5.1.7
4.2.4
3.1.3

Affected products

  • isaacs minimatch

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.