Skip to content
Fencer Vulns
high 7.5

CVE-2026-27904 json

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

published 2026-02-26 8 mo ago modified 2026-09-10 1 mo ago also GHSA-23c5-xmqv-rm74 , EUVD-2026-8802

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Patch / fix

  • npm minimatch 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3
  • minimatch_project minimatch 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3
  • node-minimatch Debian 14 9.0.7-1

debian advisories DEBIAN-CVE-2026-27904

  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.5-1.el8ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.5-1.el9ap
  • python3.12-click ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 8.3.3-1.el8ap
  • python3.12-click ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 8.3.3-1.el9ap
  • python3.12-pillow ansible automation platform 2.5 12.2.0-1.el8ap
  • python3.12-pillow ansible automation platform 2.5 12.2.0-1.el9ap
  • python3.12-cryptography ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 46.0.7-1.el8ap
  • python3.12-cryptography ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 46.0.7-1.el9ap

red hat advisories RHSA-2026:24761RHSA-2026:18054RHSA-2026:18055RHSA-2026:9874RHSA-2026:9711RHSA-2026:8339

  • cockpit-subscriptions SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 16.2-160000.1.1
  • cockpit SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 364-160000.1.1
  • cockpit-repos SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.8-160000.1.1
  • cockpit-podman SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 128-160000.1.1
  • cockpit-machines SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 354-160000.1.1
  • cockpit-packages SLES for SAP applications 16.0, SLES 16.0 5-160000.1.1
  • cockpit SLE Micro 5.5 298-150500.3.12.1

suse advisories SUSE-SU-2026:22770-1SUSE-SU-2026:22837-1SUSE-SU-2026:2363-1

  • cockpit-repos openSUSE Tumbleweed 4.9-1.1
  • cockpit-subscriptions openSUSE Tumbleweed 16.3-1.1
  • cockpit-subscriptions openSUSE Leap 16.0 16.2-160000.1.1
  • cockpit openSUSE Leap 16.0 364-160000.1.1
  • cockpit-repos openSUSE Leap 16.0 4.8-160000.1.1
  • cockpit-podman openSUSE Leap 16.0 128-160000.1.1
  • cockpit-machines openSUSE Leap 16.0 354-160000.1.1
  • cockpit-packages openSUSE Leap 16.0 5-160000.1.1

opensuse advisories openSUSE-SU-2026:11446-1openSUSE-SU-2026:11447-1openSUSE-SU-2026:21399-1openSUSE-SU-2026:21266-1openSUSE-SU-2026:11178-1openSUSE-SU-2026:11146-1

  • npm AlmaLinux 8 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda
  • nodejs AlmaLinux 8 1:20.20.2-1.module_el8.10.0+4165+3f200bda
  • nodejs-nodemon AlmaLinux 8 3.0.1-1.module_el8.10.0+3982+85c136aa
  • nodejs-full-i18n AlmaLinux 8 1:20.20.2-1.module_el8.10.0+4165+3f200bda
  • nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4165+3f200bda
  • nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4165+3f200bda
  • npm AlmaLinux 9 1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b
  • npm AlmaLinux 9 1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870

almalinux advisories ALSA-2026:8339ALSA-2026:7896ALSA-2026:7123

  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1924+614dc87f
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1935+d3cbe60f
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1666+930e28e8
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1667+4a788d89
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1989+e60144d9
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1988+437f3d23
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.9.0+1760+903d54b9
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1823+b5789597

rocky linux advisories RLSA-2026:8339RLSA-2026:7896RLSA-2026:7080RLSA-2026:7302RLSA-2026:7123

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-27904 updated cvss 6.5

minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9, openshift-logging/fluentd-rhel9, openshift-logging/kibana6-rhel8, openshift-logging/eventrouter-rhel9, openshift-logging/elasticsearch6-rhel9, openshift-logging/logging-curator5-rhel9, +7 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8 Red Hat 3scale API Management Platform 2 3scale-amp20/system, 3scale-amp21/system, 3scale-amp22/system, 3scale-amp24/system, 3scale-amp25/system, 3scale-amp26/system, +3 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry
    affected: no fix planned “Will not fix”
  • Red Hat Data Grid 8 org.infinispan-infinispan-console
    affected: no fix available
  • Red Hat Enterprise Linux 8 npm, nodejs, js-uglify, uglify-js, nodejs-libs, nodejs-nodemon, +3 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 10 nodejs24, nodejs-nodemon
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Fuse 7 io.hawt-project, io.apicurio-apicurito, io.hawt-hawtio-online, io.syndesis-syndesis-parent Red Hat JBoss Enterprise Application Platform 7 io.hawt-project, org.jboss.hal-hal-parent
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 8 org.jboss.hal-hal-parent, org.keycloak-keycloak-parent
    affected: no fix available, no fix planned “Will not fix”
show 26 more
  • Red Hat OpenShift Container Platform 4 openshift4/ose-monitoring-plugin-rhel8 Red Hat OpenShift Dev Spaces devspaces/machineexec-rhel9 Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel8
    affected: no fix available
  • Red Hat Single Sign-On 7 org.keycloak-keycloak-parent
    affected: no fix planned “Will not fix”
  • Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: no fix available
  • Red Hat streams for Apache Kafka 3 com.github.streamshub-console
    affected: no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260422-3.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260422-3.el9ap
    fixed: vendor fix RHSA-2026:24761
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.7-1.el9ap
    fixed: vendor fix RHSA-2026:6277
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Developer Hub 1.8 rhdh 1776784286
    fixed: vendor fix RHSA-2026:9742
  • Red Hat Developer Hub 1.9 rhdh 1777903262
    fixed: vendor fix RHSA-2026:13826
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 20.20.2-1.module+el8.10.0+24197+1602b452, nodejs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs-libs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs-nodemon 3.0.1-1.module+el8.10.0+23521+490ebfde, nodejs-nodemon 3.0.1-1.module+el8.10.0+24148+847b6786, npm 10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452, +7 more
    fixed: vendor fix RHSA-2026:8339
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 20.20.2-1.module+el9.7.0+24193+41b7b572, nodejs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs-libs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs-nodemon 3.0.1-1.module+el9.7.0+24157+8ddb2461, nodejs-nodemon 3.0.1-1.module+el9.7.0+24193+41b7b572, npm 10.8.2-1.20.20.2.1.module+el9.7.0+24193+41b7b572, +7 more
    fixed: vendor fix RHSA-2026:7896
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.22.2-1.el10_1, nodejs22 22.22.2-1.el10_1, nodejs-libs 22.22.2-1.el10_1, nodejs-full-i18n 22.22.2-1.el10_1, nodejs-npm 10.9.7-1.22.22.2.1.el10_1
    fixed: vendor fix RHSA-2026:7080
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs 22.22.2-2.el10_0, nodejs22 22.22.2-2.el10_0, nodejs-libs 22.22.2-2.el10_0, nodejs-full-i18n 22.22.2-2.el10_0, nodejs-npm 10.9.7-1.22.22.2.2.el10_0
    fixed: vendor fix RHSA-2026:7310
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) nodejs 20.20.2-2.module+el9.4.0+24216+64c58546, npm 10.8.2-1.20.20.2.2.module+el9.4.0+24216+64c58546, nodejs-nodemon 3.0.1-1.module+el9.3.0.z+20478+84a9f781, nodejs-full-i18n 20.20.2-2.module+el9.4.0+24216+64c58546, nodejs-packaging 2021.06-4.module+el9.3.0+19518+63aad52d, nodejs-packaging-bundler 2021.06-4.module+el9.3.0+19518+63aad52d
    fixed: vendor fix RHSA-2026:9711
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 20.20.2-2.module+el9.6.0+24220+c44c288d, nodejs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-libs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-nodemon 3.0.1-1.module+el9.6.0+23146+be9976bd, nodejs-nodemon 3.0.1-1.module+el9.6.0+23473+45664c2d, npm 10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d, +7 more
    fixed: vendor fix RHSA-2026:9874
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-hal-console 3.7.19-1.Final_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2026:18054
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-hal-console 3.7.19-1.Final_redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2026:18055
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA hal-console 3.7.19.Final-redhat-00001
    fixed: vendor fix RHSA-2026:18059
  • Red Hat Migration Toolkit for Applications 8.1 mta/mta-ui-rhel9 1785169013
    fixed: vendor fix RHSA-2026:50300
  • Red Hat OpenShift AI 2.25 rhoai 1776257621, rhoai 1776319193, rhoai 1776319213, rhoai 1776319275, rhoai 1776336652, rhoai 1776413275, +6 more
    fixed: vendor fix RHSA-2026:10184
  • Red Hat Openshift Data Foundation 4.16 odf4/cephcsi-rhel9 1791969746, odf4/odf-cli-rhel9 1791966130, odf4/mcg-core-rhel9 1791967127, odf4/odf-console-rhel9 1791966989, odf4/mcg-rhel9-operator 1791970996, odf4/ocs-rhel9-operator 1791968560, +12 more
    fixed: vendor fix RHSA-2026:83619
  • Red Hat Openshift Data Foundation 4.17 odf4/cephcsi-rhel9 1791966003, odf4/odf-cli-rhel9 1791888742, odf4/mcg-core-rhel9 1791889616, odf4/odf-console-rhel9 1791887928, odf4/mcg-rhel9-operator 1791889753, odf4/ocs-rhel9-operator 1791960285, +13 more
    fixed: vendor fix RHSA-2026:83622
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1783676191, odf4/odf-cli-rhel9 1784094299, odf4/mcg-core-rhel9 1784094353, odf4/odf-console-rhel9 1784094725, odf4/mcg-rhel9-operator 1784093953, odf4/ocs-rhel9-operator 1783676675, +13 more
    fixed: vendor fix RHSA-2026:41941
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1783684360, odf4/odf-cli-rhel9 1784054873, odf4/mcg-core-rhel9 1784054582, odf4/odf-console-rhel9 1784055589, odf4/mcg-rhel9-operator 1784054606, odf4/ocs-rhel9-operator 1783684667, +14 more
    fixed: vendor fix RHSA-2026:41944
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1783667125, odf4/odf-cli-rhel9 1784055020, odf4/mcg-core-rhel9 1784054598, odf4/odf-console-rhel9 1784055586, odf4/mcg-rhel9-operator 1784055387, odf4/ocs-rhel9-operator 1783667611, +16 more
    fixed: vendor fix RHSA-2026:40984
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/code-rhel9 1779814592, devspaces/openvsx-rhel9 1779528224
    fixed: vendor fix RHSA-2026:21772

6 more fixed, 47 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm minimatch
>=10.0.0, <10.2.3
>=9.0.0, <9.0.7
>=8.0.0, <8.0.6
>=7.0.0, <7.4.8
>=6.0.0, <6.2.2
>=5.0.0, <5.1.8
>=4.0.0, <4.2.5
<3.1.4
10.2.3
9.0.7
8.0.6
7.4.8
6.2.2
5.1.8
4.2.5
3.1.4

Affected products

  • isaacs minimatch

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.