minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
Priority HIGH 66CWE-407Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 38 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.
Summary
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00576 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial minimatch (isaacs): 10.2.3, 9.0.7, 8.0.6 +5minimatch (npm): 10.2.3, 9.0.7, 8.0.6 +5Red Hat: 2 advisoriesRed Hat: 2 fixed, 38 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| isaacs | minimatch | 10.0.0 to before 10.2.3; 9.0.0 to before 9.0.7; 8.0.0 to before 8.0.6; 7.0.0 to before 7.4.8; 6.0.0 to before 6.2.2; 5.0.0 to before 5.1.8; 4.0.0 to before 4.2.5; before 3.1.3 | 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 | Patch available | CNA |
| — | minimatch (npm) | 10.0.0 to before 10.2.3 | 10.2.3 | Patch available | GHSA-7r86-cg39-jmmj |
| — | minimatch (npm) | 9.0.0 to before 9.0.7 | 9.0.7 | Patch available | GHSA-7r86-cg39-jmmj |
| — | minimatch (npm) | 8.0.0 to before 8.0.6 | 8.0.6 | Patch available | GHSA-7r86-cg39-jmmj |
| — | minimatch (npm) | 7.0.0 to before 7.4.8 | 7.4.8 | Patch available | GHSA-7r86-cg39-jmmj |
| — | minimatch (npm) | 6.0.0 to before 6.2.2 | 6.2.2 | Patch available | GHSA-7r86-cg39-jmmj |
| — | minimatch (npm) | 5.0.0 to before 5.1.8 | 5.1.8 | Patch available | GHSA-7r86-cg39-jmmj |
| — | minimatch (npm) | 4.0.0 to before 4.2.5 | 4.2.5 | Patch available | GHSA-7r86-cg39-jmmj |
| — | minimatch (npm) | before 3.1.3 | 3.1.3 | Patch available | GHSA-7r86-cg39-jmmj |
- minimatch Vendorisaacs Affected 10.0.0 to before 10.2.3; 9.0.0 to before 9.0.7; 8.0.0 to before 8.0.6; 7.0.0 to before 7.4.8; 6.0.0 to before 6.2.2; 5.0.0 to before 5.1.8; 4.0.0 to before 4.2.5; before 3.1.3 Fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 Patch available CNA
- minimatch (npm) Vendor— Affected 10.0.0 to before 10.2.3 Fixed in 10.2.3 Patch available GHSA-7r86-cg39-jmmj
- minimatch (npm) Vendor— Affected 9.0.0 to before 9.0.7 Fixed in 9.0.7 Patch available GHSA-7r86-cg39-jmmj
- minimatch (npm) Vendor— Affected 8.0.0 to before 8.0.6 Fixed in 8.0.6 Patch available GHSA-7r86-cg39-jmmj
- minimatch (npm) Vendor— Affected 7.0.0 to before 7.4.8 Fixed in 7.4.8 Patch available GHSA-7r86-cg39-jmmj
- minimatch (npm) Vendor— Affected 6.0.0 to before 6.2.2 Fixed in 6.2.2 Patch available GHSA-7r86-cg39-jmmj
- minimatch (npm) Vendor— Affected 5.0.0 to before 5.1.8 Fixed in 5.1.8 Patch available GHSA-7r86-cg39-jmmj
- minimatch (npm) Vendor— Affected 4.0.0 to before 4.2.5 Fixed in 4.2.5 Patch available GHSA-7r86-cg39-jmmj
- minimatch (npm) Vendor— Affected before 3.1.3 Fixed in 3.1.3 Patch available GHSA-7r86-cg39-jmmj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:* | before 3.1.3; 4.0.0 to before 4.2.5; 5.0.0 to before 5.1.8; 6.0.0 to before 6.2.2; 7.0.0 to before 7.4.8; 8.0.0 to before 8.0.6; 9.0.0 to before 9.0.7; 10.0.0 to before 10.2.3 | Vulnerable | Minimatch Project |
- cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:* Versions before 3.1.3; 4.0.0 to before 4.2.5; 5.0.0 to before 5.1.8; 6.0.0 to before 6.2.2; 7.0.0 to before 7.4.8; 8.0.0 to before 8.0.6; 9.0.0 to before 9.0.7; 10.0.0 to before 10.2.3 Vulnerable ·Minimatch Project
Remediation
- Fix · CNA minimatch (isaacs) Fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
- Fix · GHSA-7r86-cg39-jmmj minimatch (npm) Fixed in 10.2.3 Advisory →
- Fix · GHSA-7r86-cg39-jmmj minimatch (npm) Fixed in 9.0.7 Advisory →
- Fix · GHSA-7r86-cg39-jmmj minimatch (npm) Fixed in 8.0.6 Advisory →
- Fix · GHSA-7r86-cg39-jmmj minimatch (npm) Fixed in 7.4.8 Advisory →
- Fix · GHSA-7r86-cg39-jmmj minimatch (npm) Fixed in 6.2.2 Advisory →
- Fix · GHSA-7r86-cg39-jmmj minimatch (npm) Fixed in 5.1.8 Advisory →
- Fix · GHSA-7r86-cg39-jmmj minimatch (npm) Fixed in 4.2.5 Advisory →
- Fix · GHSA-7r86-cg39-jmmj minimatch (npm) Fixed in 3.1.3 Advisory →
Red Hat 2 advisories
- RHSA-2026:86618 Released 2026-10-21 · Red Hat rating CriticalNew container image: rhceph-9.2
- Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 11 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 12 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 13 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9.2 | Fixed | RHSA-2026:86618 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
Not affected: 2 products
- Red Hat Ceph Storage 9.2
- Red Hat Openshift Data Foundation 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27903
- 2026-10-03 Alias added: GHSA-7r86-cg39-jmmj
- 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
- 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat
- 2026-10-24 EPSS moved to the 50th–90th percentile
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-10-27 Affected versions changed · Red Hat
References
More isaacs vulnerabilities
- TI-2026-42687 node-tar: Decompression/parse DoS via unlimited input CVSS 4.0CRITICAL 9.2
- TI-2026-42688 node-tar: Negative tar entry size causes infinite loop in archive replace CVSS 4.0HIGH 8.7
- TI-2026-51656 Uncontrolled resource consumption in isaacs node-tar CVSS 3.1HIGH 7.5
- TI-2026-42686 node-tar: Process crash via PAX numeric path type confusion CVSS 3.1HIGH 7.5
- TI-2026-24357 node-tar Symlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
- TI-2026-23372 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
Sources
- CVE-2026-27903 · CVE Program
- CVE-2026-27903 · NVD
- FIRST EPSS
- GHSA-7r86-cg39-jmmj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-27903 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences