Read the docs
TI-2026-22248 Aliases CVE-2026-27904GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Priority HIGH 66CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 29 fixed, 17 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00525 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial minimatch (isaacs): 10.2.3, 9.0.7, 8.0.6 +5minimatch (npm): 10.2.3, 9.0.7, 8.0.6 +5Red Hat: 35 advisoriesRed Hat: 29 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
isaacsminimatch10.0.0 to before 10.2.3; 9.0.0 to before 9.0.7; 8.0.0 to before 8.0.6; 7.0.0 to before 7.4.8; 6.0.0 to before 6.2.2; 5.0.0 to before 5.1.8; 4.0.0 to before 4.2.5; before 3.1.410.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4Patch availableCNA
—minimatch (npm)10.0.0 to before 10.2.310.2.3Patch availableGHSA-23c5-xmqv-rm74
—minimatch (npm)9.0.0 to before 9.0.79.0.7Patch availableGHSA-23c5-xmqv-rm74
—minimatch (npm)8.0.0 to before 8.0.68.0.6Patch availableGHSA-23c5-xmqv-rm74
—minimatch (npm)7.0.0 to before 7.4.87.4.8Patch availableGHSA-23c5-xmqv-rm74
—minimatch (npm)6.0.0 to before 6.2.26.2.2Patch availableGHSA-23c5-xmqv-rm74
—minimatch (npm)5.0.0 to before 5.1.85.1.8Patch availableGHSA-23c5-xmqv-rm74
—minimatch (npm)4.0.0 to before 4.2.54.2.5Patch availableGHSA-23c5-xmqv-rm74
—minimatch (npm)before 3.1.43.1.4Patch availableGHSA-23c5-xmqv-rm74
  • minimatch Vendorisaacs Affected 10.0.0 to before 10.2.3; 9.0.0 to before 9.0.7; 8.0.0 to before 8.0.6; 7.0.0 to before 7.4.8; 6.0.0 to before 6.2.2; 5.0.0 to before 5.1.8; 4.0.0 to before 4.2.5; before 3.1.4 Fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 Patch available CNA
  • minimatch (npm) Vendor— Affected 10.0.0 to before 10.2.3 Fixed in 10.2.3 Patch available GHSA-23c5-xmqv-rm74
  • minimatch (npm) Vendor— Affected 9.0.0 to before 9.0.7 Fixed in 9.0.7 Patch available GHSA-23c5-xmqv-rm74
  • minimatch (npm) Vendor— Affected 8.0.0 to before 8.0.6 Fixed in 8.0.6 Patch available GHSA-23c5-xmqv-rm74
  • minimatch (npm) Vendor— Affected 7.0.0 to before 7.4.8 Fixed in 7.4.8 Patch available GHSA-23c5-xmqv-rm74
  • minimatch (npm) Vendor— Affected 6.0.0 to before 6.2.2 Fixed in 6.2.2 Patch available GHSA-23c5-xmqv-rm74
  • minimatch (npm) Vendor— Affected 5.0.0 to before 5.1.8 Fixed in 5.1.8 Patch available GHSA-23c5-xmqv-rm74
  • minimatch (npm) Vendor— Affected 4.0.0 to before 4.2.5 Fixed in 4.2.5 Patch available GHSA-23c5-xmqv-rm74
  • minimatch (npm) Vendor— Affected before 3.1.4 Fixed in 3.1.4 Patch available GHSA-23c5-xmqv-rm74

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*before 3.1.4; 4.0.0 to before 4.2.5; 5.0.0 to before 5.1.8; 6.0.0 to before 6.2.2; 7.0.0 to before 7.4.8; 8.0.0 to before 8.0.6; 9.0.0 to before 9.0.7; 10.0.0 to before 10.2.3VulnerableMinimatch Project
  • cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:* Versions before 3.1.4; 4.0.0 to before 4.2.5; 5.0.0 to before 5.1.8; 6.0.0 to before 6.2.2; 7.0.0 to before 7.4.8; 8.0.0 to before 8.0.6; 9.0.0 to before 9.0.7; 10.0.0 to before 10.2.3 Vulnerable ·Minimatch Project

Remediation

  • Fix · CNA minimatch (isaacs) Fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
  • Fix · GHSA-23c5-xmqv-rm74 minimatch (npm) Fixed in 10.2.3 Advisory →
  • Fix · GHSA-23c5-xmqv-rm74 minimatch (npm) Fixed in 9.0.7 Advisory →
  • Fix · GHSA-23c5-xmqv-rm74 minimatch (npm) Fixed in 8.0.6 Advisory →
  • Fix · GHSA-23c5-xmqv-rm74 minimatch (npm) Fixed in 7.4.8 Advisory →
  • Fix · GHSA-23c5-xmqv-rm74 minimatch (npm) Fixed in 6.2.2 Advisory →
  • Fix · GHSA-23c5-xmqv-rm74 minimatch (npm) Fixed in 5.1.8 Advisory →
  • Fix · GHSA-23c5-xmqv-rm74 minimatch (npm) Fixed in 4.2.5 Advisory →
  • Fix · GHSA-23c5-xmqv-rm74 minimatch (npm) Fixed in 3.1.4 Advisory →

Red Hat 35 advisories

  • RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
    New container image: rhceph-9.2
    • Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
  • RHSA-2026:83622 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:83619 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
Show 32 more Red Hat advisories
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:51349 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:50300 Released 2026-08-04 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:26225 Released 2026-06-16 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:26214 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:24761 Released 2026-06-09 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.29-2.el8ap, automation-gateway-proxy-server-2.5.10-6.el8ap, automation-gateway-server-2.5.20260422-3.el8ap +4
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.29-2.el9ap, automation-gateway-proxy-server-2.6.14-3.el9ap, automation-gateway-server-2.5.20260422-3.el9ap +4
  • RHSA-2026:21772 Released 2026-05-28 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.28.0 Release.
    • Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +3
  • RHSA-2026:18054 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el8eap +47
  • RHSA-2026:18055 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el9eap +47
  • RHSA-2026:18059 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.6.GA io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, org.apache.activemq.artemis-server-2.40.0.redhat-00012.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +7
  • RHSA-2026:13826 Released 2026-05-05 · Red Hat rating Critical
    Red Hat Developer Hub 1.9.4 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:9874 Released 2026-04-22 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20, nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20, nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20 +20
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:9711 Released 2026-04-22 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) nodejs-1:20.20.2-2.module+el9.4.0+24216+64c58546.aarch64::nodejs:20, nodejs-1:20.20.2-2.module+el9.4.0+24216+64c58546.ppc64le::nodejs:20, nodejs-1:20.20.2-2.module+el9.4.0+24216+64c58546.s390x::nodejs:20 +20
  • RHSA-2026:8339 Released 2026-04-15 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.aarch64::nodejs:20, nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.ppc64le::nodejs:20, nodejs-1:20.20.2-1.module+el8.10.0+24197+1602b452.s390x::nodejs:20 +20
  • RHSA-2026:7983 Released 2026-04-14 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.s390x::nodejs:22 +28
  • RHSA-2026:7896 Released 2026-04-13 · Red Hat rating Important
    nodejs:20 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:20.20.2-1.module+el9.7.0+24193+41b7b572.aarch64::nodejs:20, nodejs-1:20.20.2-1.module+el9.7.0+24193+41b7b572.ppc64le::nodejs:20, nodejs-1:20.20.2-1.module+el9.7.0+24193+41b7b572.s390x::nodejs:20 +20
  • RHSA-2026:7310 Released 2026-04-09 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.22.2-2.el10_0, nodejs-devel-1:22.22.2-2.el10_0, nodejs-docs-1:22.22.2-2.el10_0 +4
  • RHSA-2026:7302 Released 2026-04-09 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22 +28
  • RHSA-2026:7123 Released 2026-04-08 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22 +28
  • RHSA-2026:7080 Released 2026-04-08 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.22.2-1.el10_1, nodejs-devel-1:22.22.2-1.el10_1, nodejs-docs-1:22.22.2-1.el10_1 +4
  • RHSA-2026:6568 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.15.4
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6567 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:6497 Released 2026-04-02 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:6277 Released 2026-03-31 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-gateway-proxy-2.6.14-1.el9, automation-gateway-proxy-server-2.6.14-1.el9, automation-platform-ui-2.6.7-1.el9ap +1
  • RHSA-2026:5665 Released 2026-03-24 · Red Hat rating Important
    Red Hat Quay 3.10.19
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:5168 Released 2026-03-19 · Red Hat rating Important
    Red Hat Quay 3.9.19
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:4942 Released 2026-03-18 · Red Hat rating Important
    Red Hat Quay 3.12.15
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
OpenShift PipelinesAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Self-service automation portal 2AffectedNo fix yet
streams for Apache Kafka 3AffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:24761
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:24761
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:6277
Red Hat Ceph Storage 9.2Fixed RHSA-2026:86618
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Developer Hub 1.9Fixed RHSA-2026:13826
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:7080
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:7123, RHSA-2026:8339
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:7302, RHSA-2026:7896
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:7310
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:9711
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:7983, RHSA-2026:9874
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:18054
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:18055
Red Hat JBoss Enterprise Application Platform 8.1.6.GAFixed RHSA-2026:18059
Red Hat Migration Toolkit for Applications 8.1Fixed RHSA-2026:50300
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184, RHSA-2026:65126
Red Hat OpenShift Dev Spaces 3.28Fixed RHSA-2026:21772
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2026:83619
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:83622
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Quay 3.10Fixed RHSA-2026:5665
Red Hat Quay 3.12Fixed RHSA-2026:4942
Red Hat Quay 3.15Fixed RHSA-2026:6568
Red Hat Quay 3.16Fixed RHSA-2026:6497, RHSA-2026:6567
Red Hat Quay 3.9Fixed RHSA-2026:5168
Red Hat Satellite 6.18Fixed RHSA-2026:26214, RHSA-2026:26225, RHSA-2026:51349
Not affected: 47 products
  • Cryostat 4
  • Gatekeeper 3
  • Node HealthCheck Operator
  • OpenShift Service Mesh 3
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ceph Storage 9.2
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat Directory Server 11
  • Red Hat Directory Server 12
  • Red Hat Directory Server 13
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Fuse 7
  • Red Hat JBoss EAP 8.1 for RHEL 8
  • Red Hat JBoss EAP 8.1 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit for Applications 8.1
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Process Automation 7
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of OptaPlanner 8
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27904
  2. 2026-10-03 Alias added: GHSA-23c5-xmqv-rm74
  3. 2026-10-16 Fix available: RHSA-2026:83619 · Red Hat
  4. 2026-10-16 Fix available: RHSA-2026:83622 · Red Hat
  5. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1, Red Hat Openshift Data Foundation 4.16, Red Hat Openshift Data Foundation 4.17 · Red Hat
  6. 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.6.GA · Red Hat
  7. 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
  8. 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-42687 node-tar: Decompression/parse DoS via unlimited input CVSS 4.0CRITICAL 9.2
  • TI-2026-42688 node-tar: Negative tar entry size causes infinite loop in archive replace CVSS 4.0HIGH 8.7
  • TI-2026-51656 Uncontrolled resource consumption in isaacs node-tar CVSS 3.1HIGH 7.5
  • TI-2026-42686 node-tar: Process crash via PAX numeric path type confusion CVSS 3.1HIGH 7.5
  • TI-2026-24357 node-tar Symlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
  • TI-2026-23372 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences