Loading vulnerability…
Regular Expression Denial of Service in minimatch
CVE-2026-26996 is a regular expression denial-of-service vulnerability in minimatch, a JavaScript utility that converts glob patterns into regular expressions. A crafted pattern containing many consecutive '*' wildcards followed by a literal character absent from the test string causes exponential backtracking. Each wildcard compiles into a separate lazy, non-slash matching regex group, forcing V8's regex engine to explore combinations of string partitions when matching fails. Applications that pass attacker-controlled patterns to minimatch() can experience prolonged CPU consumption and effectively indefinite hangs. The vulnerability affects the 10.x branch through version 10.2.0 and earlier release branches without the corresponding backported fix.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust CPU resources and block the executing JavaScript thread, causing severe slowdown or application unavailability. In Node.js services performing matching on the main thread, a malicious pattern can block the event loop and prevent unrelated requests from being processed. A single matching operation can cause substantial disruption. The vulnerability has a high availability impact, with no identified direct confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Until patched, avoid passing untrusted input as the minimatch() pattern argument. Restrict patterns to trusted, predefined values where possible, or validate and constrain pattern complexity, particularly long sequences of consecutive '*' wildcards. Restrict access to interfaces that evaluate untrusted patterns and apply rate limiting as a supplemental control; rate limiting alone does not prevent a single expensive matching operation from blocking execution.
Patch, then assume compromise.
Upgrade minimatch to the fixed release for the installed branch: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, or 3.1.3, or a later release in the corresponding branch. Update affected direct and transitive dependencies. For vendor-bundled copies, apply the applicable vendor security update rather than relying solely on an independently installed minimatch package. Identified product fixes include HCL Hive 1.2, HCL ZIE for Web 16.0.2, HCL BigFix AEX 2026.10.03.01, and Red Hat JBoss EAP 8.1.6; affected Red Hat Node.js packages also have product-specific security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.