CVE-2026-27903 — Inefficient Algorithmic Complexity in Minimatch

CWE-407 — Inefficient Algorithmic ComplexityCWE-1333 — Regex Denial of Service7 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 92.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Isaacs MinimatchMinimatch Project MinimatchDebian Node-minimatch
Timeline
PublishedFeb 26

Description

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/node-minimatch< node-minimatch 9.0.7-1 (sid)
▶CVEListV5isaacs/minimatch< 3.1.3+7
▶NVDminimatch_project/minimatch4.0.0 — 4.2.5+7
▶npmminimatch_project/minimatch10.0.0 — 10.2.3+7

🔴Vulnerability Details

3
GHSA
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments↗2026-02-26
▶
OSV
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments↗2026-02-26
▶
OSV
CVE-2026-27903: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects↗2026-02-26
▶

📋Vendor Advisories

2
Red Hat
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns↗2026-02-26
▶
Debian
CVE-2026-27903: node-minimatch - minimatch is a minimal matching utility for converting glob expressions into Jav...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-27903 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-27903 — Inefficient Algorithmic Complexity | cvebase