CVEvulnerability

CVE-2026-118773

6.3 MEDIUM EPSS 0.35% Published 2026-10-29 Modified 2026-10-30 Official page ↗

Exploitation and prioritisation

EPSS
0.35% chance of exploitation in the next 30 days · in the top 71.3% of all CVEs (2026-11-03)
CISA SSVC: exploitation
none
CISA SSVC: automatable
no
CISA SSVC: technical impact
partial
EU Vulnerability Database
EUVD-2026-113329

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
npmglob>= 9.0.0, < 14.0.214.0.2GHSA-3g3m-2fjr-6pw4
Status
Awaiting Analysis
Published
2026-10-29
Last modified
2026-10-30
Assigner
[email protected]
CVSS 4.0 ([email protected])
6.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-400

Description

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-3g3m-2fjr-6pw4 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal advisory · npm

References