CVE-2026-118773: 
JavaScript Análisis y mitigación de vulnerabilidades

CVE-2026-118773 is an AbortSignal cancellation bypass vulnerability in the node-glob npm package (isaacs/glob) that allows post-timeout filesystem traversal to continue after a walk has been aborted. Affecting versions >= 9.0.0 and < 14.0.2, the flaw causes abort branches in src/walker.ts to invoke callbacks without returning, allowing recursive directory traversal to persist after cancellation. It was disclosed on October 27–29, 2026, with a fix released in v14.0.2. The vulnerability carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). In src/walker.ts, the methods GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync() check this.signal?.aborted and call cb() to signal cancellation, but fail to include a return statement — allowing execution to fall through into processor.processPatterns(), readdirCB(), and recursive traversal calls. The fix is a one-character change per branch: replacing cb() with return cb(). A proof-of-concept was included in the advisory, demonstrating that on glob v13.0.6, aborting after the first readdir() call still resulted in 1,360 additional readdir calls after rejection (GitHub Advisory, Fix Commit).

The vulnerability is limited to availability impact — no confidentiality or integrity compromise was observed. Applications that expose glob() or globStream() over attacker-influenced patterns or directory trees and rely on AbortSignal or AbortSignal.timeout() as a traversal budget are at risk: repeated timed-out requests can stack background filesystem I/O and CPU work, degrading Node.js worker throughput or causing service unavailability. The impact is proportional to the depth and breadth of the directory tree being traversed (GitHub Advisory).

No in-the-wild exploitation has been reported, and no weaponized exploit kits are known. A proof-of-concept script was included in the GitHub Security Advisory demonstrating the bypass. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that the application expose glob traversal over attacker-influenced patterns or directory trees with AbortSignal-based cancellation, which is a specific but realistic deployment pattern (GitHub Advisory).

1. Identify a vulnerable target: Find a Node.js application using glob npm package versions >= 9.0.0 and <= 14.0.1 that accepts user-supplied glob patterns or operates on attacker-influenced directory trees, and uses AbortSignal or AbortSignal.timeout() to limit traversal time.
2. Craft a deep/wide glob pattern: Prepare a glob pattern (e.g., **) targeting a large or deeply nested directory tree to maximize the number of readdir calls triggered per request.
3. Send repeated requests with short timeouts: Submit multiple concurrent or sequential requests using patterns that trigger AbortSignal.timeout() to fire early, causing the application to reject the promise while background traversal continues.
4. Stack background operations: Each timed-out request leaves orphaned filesystem I/O and CPU work running in the background. Repeating this causes these operations to accumulate, exhausting worker thread capacity and degrading or denying service availability (GitHub Advisory).

• Process: Node.js worker processes showing sustained high CPU usage or elevated filesystem I/O after requests have been rejected or timed out; readdir system calls continuing well after the associated HTTP request has completed.
• Logs: Application logs showing repeated TimeoutError: The operation was aborted due to timeout or similar AbortSignal rejection errors in rapid succession from the same source IP or endpoint.
• Network: High volume of repeated requests to endpoints that perform glob-based file searches, particularly with patterns like ** or deeply nested wildcards, especially from a single client.
• Runtime Metrics: Increasing event loop lag or worker thread saturation in Node.js APM/monitoring tools correlating with glob-related request spikes (GitHub Advisory).

Upgrade the glob npm package to version 14.0.2 or later, which adds return before each cb() call in the four affected abort branches of src/walker.ts (Fix Commit, Release v14.0.2). As a workaround for applications that cannot immediately upgrade, avoid exposing glob traversal over attacker-controlled patterns or directory trees, or implement application-level rate limiting and request queuing to limit concurrent glob operations. There is no configuration-only mitigation that fully addresses the missing return in the abort branches.