CVE-2026-27903: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27903 is a Denial of Service (ReDoS) vulnerability in the minimatch npm package, caused by unbounded recursive backtracking in the matchOne() function when processing glob patterns with multiple non-adjacent ** (GLOBSTAR) segments. It affects all minimatch versions prior to 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, and 10.2.3 for Node.js. The vulnerability was published on February 25, 2026, by researcher dolevmiz1, and disclosed via GitHub Advisory GHSA-7r86-cg39-jmmj. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-407 (Inefficient Algorithmic Complexity) and CWE-1333 (Inefficient Regular Expression Complexity). The vulnerable loop in matchOne() at src/index.ts#L960 iterates over every suffix of remaining file path segments when a GLOBSTAR (**) is encountered, recursively calling itself for each. With k non-adjacent globstars and n file path segments, the total recursive call count is O(C(n, k)) — binomial complexity — with no memoization, depth counter, or call budget to bound the behavior. An attacker needs only to supply a crafted glob pattern (as small as 56 bytes) to a code path that passes it to minimatch(); no special options or authentication are required in contexts where pattern input is part of normal functionality. A public PoC demonstrating both inline script and HTTP server event loop starvation is available in the official security advisory (Github Advisory, Patch Commit).

Successful exploitation causes a Denial of Service by stalling the Node.js event loop for tens of seconds per invocation — with k=11 globstars causing ~5.4-second stalls and k=13 causing ~15.9-second stalls — blocking all concurrent users for the full duration of each attack call. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. The attack surface is broad, encompassing build tools (ESLint, Webpack, Rollup), multi-tenant platforms with user-configurable glob rules, admin interfaces accepting filter/ignore configurations, and CI/CD pipelines processing user-submitted config files. Numerous IBM enterprise products are also affected as downstream consumers of minimatch (Github Advisory, IBM Advisory).

A public proof-of-concept exploit is available in the official GitHub Security Advisory, demonstrating both a standalone script and an HTTP server event loop starvation scenario. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.036–0.047% (low probability of exploitation in the next 30 days). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has assigned detection ID 6325236 for this vulnerability (Github Advisory, Feedly).

1. Identify attack surface: Locate an application that passes user-controlled input as a glob pattern to minimatch() — such as a web endpoint accepting filter/ignore rules, a CI/CD pipeline processing user-submitted config files, or a multi-tenant admin interface.
2. Craft a malicious glob pattern: Construct a pattern with multiple non-adjacent ** (GLOBSTAR) segments. For a ~5-second stall, use k=11 globstars with n=30 path segments (56 bytes): **/a/**/a/**/a/**/a/**/a/**/a/**/a/**/a/**/a/**/a/**/a/b.
3. Craft a non-matching path: Pair the pattern with a long non-matching path (e.g., 30 a segments joined by /: a/a/a/a/.../a) to force the full recursive backtracking.
4. Submit the payload: Deliver the crafted pattern and path to the vulnerable endpoint (e.g., via HTTP query parameters, config file upload, or API call). No authentication is required in contexts where pattern input is part of normal functionality.
5. Achieve event loop starvation: The Node.js event loop is blocked for the duration of the recursive computation, causing all concurrent requests to the server to time out or queue, resulting in a denial of service for all users (Github Advisory).

• Network: Repeated HTTP requests to endpoints that accept glob pattern parameters (e.g., query strings containing ** sequences with many / separators); unusually long response times or timeouts on otherwise fast endpoints.
• Logs: Node.js application logs showing requests that take 5–20+ seconds to process; event loop lag metrics spiking to multi-second values; access logs with URL-encoded glob patterns containing multiple %2F**%2F sequences.
• Process: Node.js process CPU usage pegged at 100% for extended periods (5–20 seconds) without corresponding I/O activity; application health checks failing or timing out during attack windows.
• Application Behavior: All concurrent users experiencing simultaneous slowdowns or timeouts correlated with a single inbound request containing a complex glob pattern (Github Advisory).

Upgrade minimatch to one of the patched versions: 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, or 10.2.3. The fix introduces a maxGlobstarRecursion option (default: 200) that limits the number of non-adjacent ** patterns recursively walked, treating excessive patterns as non-matching rather than exhaustively backtracking. As a workaround where upgrading is not immediately possible, restrict or sanitize glob pattern input from untrusted sources — validate that patterns do not contain more than a small number of ** segments before passing them to minimatch(). Review and audit all build tools, task runners, and CI/CD configurations that accept user-supplied glob arguments (Patch Commit, Github Advisory).

Socket.dev published a blog post covering the three high-severity ReDoS vulnerabilities patched in minimatch, highlighting the broad downstream impact given the library's widespread use in the Node.js ecosystem (Socket.dev Blog). IBM issued more than a dozen security bulletins across its product portfolio — including Maximo Application Suite, Cloud Pak for Business Automation, watsonx Orchestrate, Guardium Data Security Center, and Db2 Big SQL — acknowledging the vulnerability in bundled minimatch dependencies. The vulnerability was also noted in the context of downstream projects such as LangGraph CLI and React Native release notes, reflecting the library's pervasive use. Community discussion on Bluesky and security aggregators noted the low exploit complexity and broad attack surface.