CVE-2026-26996: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26996 is a Regular Expression Denial of Service (ReDoS) vulnerability in the minimatch npm package, a widely used glob-to-RegExp utility for Node.js. It was disclosed on February 17, 2026, and published to the GitHub Advisory Database on February 18, 2026. The vulnerability affects all major version branches prior to their respective patched releases: versions < 3.1.3, 4.x < 4.2.4, 5.x < 5.1.7, 6.x < 6.2.1, 7.x < 7.4.7, 8.x < 8.0.5, 9.x < 9.0.6, and 10.x < 10.2.1. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity). When minimatch compiles a glob pattern, each * wildcard is translated into a separate [^/]*? regex group. A pattern with many consecutive * characters (e.g., ***************X***) generates a regex with numerous independent lazy-match groups. When the test string does not contain the literal character following the wildcards (e.g., X), V8's regex engine must exhaustively backtrack across all possible ways to distribute input characters among the groups, resulting in O(4^N) time complexity where N is the number of * characters. With N=15, a single minimatch() call takes approximately 2 seconds; with N=34, the process hangs indefinitely. The fix, committed at isaacs/minimatch@2e111f3, coalesces consecutive non-globstar * characters into a single regex group, eliminating the exponential blowup (GitHub Advisory).

Successful exploitation causes excessive CPU consumption and can render the affected Node.js application completely unresponsive. The impact is limited to availability — there is no confidentiality or integrity impact. Any service that exposes glob pattern matching to user-controlled input (e.g., file search UIs, .gitignore-style filters, build tool APIs) is at risk of denial of service. The vulnerability has a broad downstream impact, affecting numerous IBM enterprise products (including IBM Maximo Application Suite, IBM Cloud Pak for Integration, IBM Db2 Big SQL, IBM App Connect Enterprise, and many others) that bundle vulnerable versions of minimatch (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept demonstrating the ReDoS behavior is publicly available via the GitHub Security Advisory (GitHub Advisory). No evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.042% (low probability of exploitation in the next 30 days). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication, no privileges, and no user interaction — any attacker who can supply a glob pattern to a vulnerable minimatch() call can trigger the DoS.

1. Identify a vulnerable endpoint: Locate a web application or API that accepts user-supplied glob patterns and passes them directly to minimatch() as the pattern argument (e.g., a file search UI, a filter API, or a build configuration endpoint).
2. Craft a malicious glob pattern: Construct a pattern containing a large number of consecutive * wildcards followed by a literal character unlikely to appear in the target string, such as ***************X*** (N=15 or more for noticeable impact; N=34 for an effective hang).
3. Submit the payload: Send the crafted pattern to the vulnerable endpoint via an HTTP request or any other input channel accepted by the application.
4. Trigger exponential backtracking: The minimatch library compiles the pattern into a regex with N separate [^/]*? groups. When the test string does not contain X, V8's regex engine backtracks exponentially, consuming all available CPU cycles.
5. Achieve denial of service: With sufficient * repetitions, the Node.js event loop is blocked, making the application unresponsive to all subsequent requests until the process is restarted (GitHub Advisory).

• Application Behavior: Node.js process CPU usage spikes to 100% and remains elevated; the application stops responding to new requests.
• Logs: Application logs show requests containing glob patterns with many consecutive * characters (e.g., 15 or more) followed by a literal character; requests that never complete or time out at the server level.
• Process: The Node.js worker process becomes unresponsive; monitoring tools may report event loop lag exceeding several seconds or indefinite blocking.
• Network: Repeated HTTP requests to endpoints that accept glob or filter pattern parameters, particularly with unusually long or repetitive wildcard sequences in query strings or request bodies.

Upgrade minimatch to the patched version corresponding to your major version branch: 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7, 8.0.5, 9.0.6, or 10.2.1. As a workaround where immediate upgrade is not possible, implement strict server-side input validation to reject glob patterns containing excessive consecutive * characters before passing them to minimatch(). Additionally, consider enforcing request timeouts and CPU/resource limits on pattern-matching operations to bound the impact of any single request. Red Hat has issued multiple errata (RHSA-2026:7080, 7123, 7302, 7350, 7670, 7675, 7896, 7983, 8339, 9711, 9874, 13508, 18054, 18055, 18059, 24761) addressing this vulnerability across RHEL 8, 9, 10, and related products (Red Hat Bugzilla). IBM has also released security bulletins for affected products (IBM Storage Defender).

Socket.dev published a blog post covering the three high-severity ReDoS vulnerabilities patched in minimatch, including CVE-2026-26996, highlighting the broad ecosystem impact given the package's widespread use (Socket.dev Blog). Heise Online reported on the DoS risk to IBM SPSS Collaboration and Deployment Services stemming from this vulnerability. The fix was back-ported to all supported legacy major versions of minimatch by maintainer @ljharb, which was noted positively by the community. Multiple downstream projects including LangChain's LangGraph CLI and Facebook's Lexical editor released updates referencing this CVE.