CVE-2026-26996

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

• minimatch project minimatch (>= 3.0.0 < 3.1.3) • minimatch project minimatch (>= 4.0.0 < 4.2.4) • minimatch project minimatch (>= 5.0.0 < 5.1.7) • minimatch project minimatch (>= 6.0.0 < 6.2.1) • minimatch project minimatch (>= 7.0.0 < 7.4.7) • minimatch project minimatch (>= 8.0.0 < 8.0.5) • minimatch project minimatch (>= 9.0.0 < 9.0.6) • minimatch project minimatch (>= 10.0.0 < 10.2.1)