minimatch is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits.
The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever.
Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.
When minimatch compiles a glob pattern, each * becomes [^/]*? in the generated regex. For a pattern like ***************X***:
/^(?!\.)[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?X[^/]*?[^/]*?[^/]*?$/
When the test string doesn't contain X, the regex engine must try every possible way to distribute the characters across all the [^/]*? groups before concluding no match exists. With N groups and M characters, this is O(C(N+M, N)) — exponential.
Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This includes:
- File search/filter UIs that accept glob patterns
- .gitignore-style filtering with user-defined rules
- Build tools that accept glob configuration
- Any API that exposes glob matching to untrusted input
Thanks to @ljharb for back-porting the fix to legacy versions of minimatch.
| Score | Percentile |
|---|---|
| 0.03% | 6.68% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 8.7 | 4.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-3ppc-4f35-3m26 ↗ |
| CVE | CVE-2026-26996 ↗ |
| CWE id | Name |
|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| npm | minimatch | >= 10.0.0, < 10.2.1 | 10.2.1 | — |
| npm | minimatch | >= 9.0.0, < 9.0.6 | 9.0.6 | — |
| npm | minimatch | >= 8.0.0, < 8.0.5 | 8.0.5 | — |
| npm | minimatch | >= 7.0.0, < 7.4.7 | 7.4.7 | — |
| npm | minimatch | >= 6.0.0, < 6.2.1 | 6.2.1 | — |
| npm | minimatch | >= 5.0.0, < 5.1.7 | 5.1.7 | — |
| npm | minimatch | >= 4.0.0, < 4.2.4 | 4.2.4 | — |
| npm | minimatch | < 3.1.3 | 3.1.3 | — |