Loading vulnerability…
Regular Expression Denial of Service in minimatch Nested Extglobs
CVE-2026-27904 is a regular-expression denial-of-service vulnerability in minimatch, a JavaScript glob-matching utility. Nested *() and +() extended glob expressions generate regular expressions containing nested unbounded quantifiers, causing catastrophic backtracking in V8 when evaluated against suitable non-matching strings. The default minimatch() API is affected without special options. A 12-byte pattern evaluated against an 18-byte non-matching input can stall execution for more than seven seconds; additional nesting or slightly longer inputs can extend stalls to minutes. Fixed releases are 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 for their respective release branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes excessive CPU consumption and blocks the executing JavaScript thread. In Node.js applications, this can starve the event loop, delay unrelated requests, and render the affected process unavailable for seconds to minutes per malicious evaluation. Very short patterns and input strings are sufficient. No confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
Where extended glob syntax is unnecessary, pass { noext: true } to minimatch() to disable extglob processing. Otherwise, reject untrusted nested *() and +() extglob patterns until a fixed release is deployed. Simple pattern-length limits alone are insufficient because a 12-byte pattern can trigger severe backtracking.
Patch, then assume compromise.
Upgrade minimatch to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, or 3.1.4, or a later fixed release in the applicable branch. Update affected transitive dependencies and bundled copies through their parent packages or vendor security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.