Read the docs
TI-2026-21474 Aliases CVE-2026-26996GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Priority MEDIUM 44CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 38 fixed, 16 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00577 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial minimatch (isaacs): 10.2.1minimatch (npm): 10.2.1, 9.0.6, 8.0.5 +5Red Hat: 48 advisoriesRed Hat: 38 fixed, 16 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
isaacsminimatchbefore 10.2.110.2.1Patch availableCNA
—minimatch (npm)10.0.0 to before 10.2.110.2.1Patch availableGHSA-3ppc-4f35-3m26
—minimatch (npm)9.0.0 to before 9.0.69.0.6Patch availableGHSA-3ppc-4f35-3m26
—minimatch (npm)8.0.0 to before 8.0.58.0.5Patch availableGHSA-3ppc-4f35-3m26
—minimatch (npm)7.0.0 to before 7.4.77.4.7Patch availableGHSA-3ppc-4f35-3m26
—minimatch (npm)6.0.0 to before 6.2.16.2.1Patch availableGHSA-3ppc-4f35-3m26
—minimatch (npm)5.0.0 to before 5.1.75.1.7Patch availableGHSA-3ppc-4f35-3m26
—minimatch (npm)4.0.0 to before 4.2.44.2.4Patch availableGHSA-3ppc-4f35-3m26
—minimatch (npm)before 3.1.33.1.3Patch availableGHSA-3ppc-4f35-3m26
  • minimatch Vendorisaacs Affected before 10.2.1 Fixed in 10.2.1 Patch available CNA
  • minimatch (npm) Vendor— Affected 10.0.0 to before 10.2.1 Fixed in 10.2.1 Patch available GHSA-3ppc-4f35-3m26
  • minimatch (npm) Vendor— Affected 9.0.0 to before 9.0.6 Fixed in 9.0.6 Patch available GHSA-3ppc-4f35-3m26
  • minimatch (npm) Vendor— Affected 8.0.0 to before 8.0.5 Fixed in 8.0.5 Patch available GHSA-3ppc-4f35-3m26
  • minimatch (npm) Vendor— Affected 7.0.0 to before 7.4.7 Fixed in 7.4.7 Patch available GHSA-3ppc-4f35-3m26
  • minimatch (npm) Vendor— Affected 6.0.0 to before 6.2.1 Fixed in 6.2.1 Patch available GHSA-3ppc-4f35-3m26
  • minimatch (npm) Vendor— Affected 5.0.0 to before 5.1.7 Fixed in 5.1.7 Patch available GHSA-3ppc-4f35-3m26
  • minimatch (npm) Vendor— Affected 4.0.0 to before 4.2.4 Fixed in 4.2.4 Patch available GHSA-3ppc-4f35-3m26
  • minimatch (npm) Vendor— Affected before 3.1.3 Fixed in 3.1.3 Patch available GHSA-3ppc-4f35-3m26

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*3.0.0 to before 3.1.3; 4.0.0 to before 4.2.4; 5.0.0 to before 5.1.7; 6.0.0 to before 6.2.1; 7.0.0 to before 7.4.7; 8.0.0 to before 8.0.5; 9.0.0 to before 9.0.6; 10.0.0 to before 10.2.1VulnerableMinimatch Project
  • cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:* Versions 3.0.0 to before 3.1.3; 4.0.0 to before 4.2.4; 5.0.0 to before 5.1.7; 6.0.0 to before 6.2.1; 7.0.0 to before 7.4.7; 8.0.0 to before 8.0.5; 9.0.0 to before 9.0.6; 10.0.0 to before 10.2.1 Vulnerable ·Minimatch Project

Remediation

  • Fix · CNA minimatch (isaacs) Fixed in 10.2.1
  • Fix · GHSA-3ppc-4f35-3m26 minimatch (npm) Fixed in 10.2.1 Advisory →
  • Fix · GHSA-3ppc-4f35-3m26 minimatch (npm) Fixed in 9.0.6 Advisory →
  • Fix · GHSA-3ppc-4f35-3m26 minimatch (npm) Fixed in 8.0.5 Advisory →
  • Fix · GHSA-3ppc-4f35-3m26 minimatch (npm) Fixed in 7.4.7 Advisory →
  • Fix · GHSA-3ppc-4f35-3m26 minimatch (npm) Fixed in 6.2.1 Advisory →
  • Fix · GHSA-3ppc-4f35-3m26 minimatch (npm) Fixed in 5.1.7 Advisory →
  • Fix · GHSA-3ppc-4f35-3m26 minimatch (npm) Fixed in 4.2.4 Advisory →
  • Fix · GHSA-3ppc-4f35-3m26 minimatch (npm) Fixed in 3.1.3 Advisory →

Red Hat 48 advisories

  • RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
    New container image: rhceph-9.2
    • Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
  • RHSA-2026:83622 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:83619 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
Show 45 more Red Hat advisories
  • RHSA-2026:77316 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.12.100 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-cluster-autoscaler-operator, registry.redhat.io/openshift4/ose-console +5
  • RHSA-2026:77321 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.13.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-cluster-autoscaler-operator +10
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:56912 Released 2026-08-26 · Red Hat rating Critical
    OpenShift Container Platform 4.15.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-console +5
  • RHSA-2026:56789 Released 2026-08-26 · Red Hat rating Critical
    OpenShift Container Platform 4.14.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8 +5
  • RHSA-2026:51349 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:47728 Released 2026-08-06 · Red Hat rating Critical
    OpenShift Container Platform 4.17.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9 +7
  • RHSA-2026:50300 Released 2026-08-04 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:36621 Released 2026-07-16 · Red Hat rating Important
    OpenShift Container Platform 4.16.66 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:37192 Released 2026-07-15 · Red Hat rating Important
    OpenShift Container Platform 4.18.48 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-thanos-rhel9
  • RHSA-2026:26225 Released 2026-06-16 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:26214 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:23246 Released 2026-06-10 · Red Hat rating Important
    OpenShift Container Platform 4.19.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:24761 Released 2026-06-09 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.29-2.el8ap, automation-gateway-proxy-server-2.5.10-6.el8ap, automation-gateway-server-2.5.20260422-3.el8ap +4
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.29-2.el9ap, automation-gateway-proxy-server-2.6.14-3.el9ap, automation-gateway-server-2.5.20260422-3.el9ap +4
  • RHSA-2026:21703 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.20.24 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +22
  • RHSA-2026:21709 Released 2026-06-02 · Red Hat rating Important
    OpenShift Container Platform 4.21.18 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9, registry.redhat.io/openshift4/ose-cli-rhel9 +6
  • RHSA-2026:21772 Released 2026-05-28 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.28.0 Release.
    • Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +3
  • RHSA-2026:18054 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el8eap +47
  • RHSA-2026:18055 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el9eap +47
  • RHSA-2026:18059 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.6.GA io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, org.apache.activemq.artemis-server-2.40.0.redhat-00012.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +7
  • RHSA-2026:13508 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.4-3.el10ap, receptorctl-1.6.4-3.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.11-2.el9ap, automation-controller-cli-4.7.11-2.el9ap, automation-controller-server-4.7.11-2.el9ap +25
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:9874 Released 2026-04-22 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20, nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20, nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20 +20
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:9711 Released 2026-04-22 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) nodejs-1:20.20.2-2.module+el9.4.0+24216+64c58546.aarch64::nodejs:20, nodejs-1:20.20.2-2.module+el9.4.0+24216+64c58546.ppc64le::nodejs:20, nodejs-1:20.20.2-2.module+el9.4.0+24216+64c58546.s390x::nodejs:20 +20
  • RHSA-2026:8339 Released 2026-04-15 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20, nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20, nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20 +20
  • RHSA-2026:7983 Released 2026-04-14 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.s390x::nodejs:22 +28
  • RHSA-2026:7896 Released 2026-04-13 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:20.20.2-1.module+el9.7.0+24193+41b7b572.aarch64::nodejs:20, nodejs-1:20.20.2-1.module+el9.7.0+24193+41b7b572.ppc64le::nodejs:20, nodejs-1:20.20.2-1.module+el9.7.0+24193+41b7b572.s390x::nodejs:20 +20
  • RHSA-2026:7670 Released 2026-04-13 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el8.10.0+24190+49a46c75.s390x::nodejs:24 +25
  • RHSA-2026:7675 Released 2026-04-13 · Red Hat rating Important
    nodejs24 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.14.1-2.el10_1, nodejs24-devel-1:24.14.1-2.el10_1, nodejs24-docs-1:24.14.1-2.el10_1 +3
  • RHSA-2026:7350 Released 2026-04-09 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.s390x::nodejs:24 +25
  • RHSA-2026:7310 Released 2026-04-09 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.22.2-2.el10_0, nodejs-devel-1:22.22.2-2.el10_0, nodejs-docs-1:22.22.2-2.el10_0 +4
  • RHSA-2026:7302 Released 2026-04-09 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22 +28
  • RHSA-2026:7123 Released 2026-04-08 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22 +28
  • RHSA-2026:7080 Released 2026-04-08 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.22.2-1.el10_1, nodejs-devel-1:22.22.2-1.el10_1, nodejs-docs-1:22.22.2-1.el10_1 +4
  • RHSA-2026:6568 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.15.4
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6567 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:6497 Released 2026-04-02 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:6192 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.27.0 Release.
    • Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:5665 Released 2026-03-24 · Red Hat rating Important
    Red Hat Quay 3.10.19
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:5168 Released 2026-03-19 · Red Hat rating Important
    Red Hat Quay 3.9.19
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:4942 Released 2026-03-18 · Red Hat rating Important
    Red Hat Quay 3.12.15
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Node HealthCheck OperatorAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Self-service automation portal 2AffectedNo fix yet
streams for Apache Kafka 3AffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:24761
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:24761
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:13508
Red Hat Ceph Storage 9.2Fixed RHSA-2026:86618
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:7080, RHSA-2026:7675
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:7123, RHSA-2026:7670, RHSA-2026:8339
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:7302, RHSA-2026:7350, RHSA-2026:7896
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:7310
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:9711
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:7983, RHSA-2026:9874
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:18054
Red Hat JBoss Enterprise Application Platform 8.1.6.GAFixed RHSA-2026:18059
Red Hat Migration Toolkit for Applications 8.1Fixed RHSA-2026:50300
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184, RHSA-2026:65126
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:77316
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:77321
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:56789
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:56912
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:36621
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:47728
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:37192
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:23246
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:21703
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:21709
Red Hat OpenShift Dev Spaces 3.27Fixed RHSA-2026:6192
Red Hat OpenShift Dev Spaces 3.28Fixed RHSA-2026:21772
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2026:83619
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:83622
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Quay 3.10Fixed RHSA-2026:5665
Red Hat Quay 3.12Fixed RHSA-2026:4942
Red Hat Quay 3.15Fixed RHSA-2026:6568
Red Hat Quay 3.16Fixed RHSA-2026:6497, RHSA-2026:6567
Red Hat Quay 3.9Fixed RHSA-2026:5168
Red Hat Satellite 6.18Fixed RHSA-2026:26214, RHSA-2026:26225, RHSA-2026:51349
Not affected: 55 products
  • Cryostat 4
  • Gatekeeper 3
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Service Mesh 3
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ceph Storage 9.2
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1.8
  • Red Hat Directory Server 11
  • Red Hat Directory Server 12
  • Red Hat Directory Server 13
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Fuse 7
  • Red Hat JBoss EAP 8.1 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA
  • Red Hat Migration Toolkit for Applications 8.1
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.27
  • Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Process Automation 7
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of OptaPlanner 8
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26996
  2. 2026-10-03 Alias added: GHSA-3ppc-4f35-3m26
  3. 2026-10-16 Fix available: RHSA-2026:77316 · Red Hat
  4. 2026-10-16 Fix available: RHSA-2026:77321 · Red Hat
  5. 2026-10-16 Fix available: RHSA-2026:83619 · Red Hat
  6. 2026-10-16 Fix available: RHSA-2026:83622 · Red Hat
  7. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13 +2 · Red Hat
  8. 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.6.GA · Red Hat
  9. 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
  10. 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-42687 node-tar: Decompression/parse DoS via unlimited input CVSS 4.0CRITICAL 9.2
  • TI-2026-42688 node-tar: Negative tar entry size causes infinite loop in archive replace CVSS 4.0HIGH 8.7
  • TI-2026-51656 Uncontrolled resource consumption in isaacs node-tar CVSS 3.1HIGH 7.5
  • TI-2026-42686 node-tar: Process crash via PAX numeric path type confusion CVSS 3.1HIGH 7.5
  • TI-2026-24357 node-tar Symlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
  • TI-2026-23372 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences