CVE-2026-27904: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27904 is a Regular Expression Denial of Service (ReDoS) vulnerability in the minimatch npm package, a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Nested *() and +() extglob patterns generate regular expressions with nested unbounded quantifiers (e.g., (?:(?:a|b)*)*) that exhibit catastrophic backtracking in V8. The vulnerability was disclosed on February 25, 2026, and affects all major version lines prior to the patched releases: 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, and 10.2.3. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause (CWE-1333: Inefficient Regular Expression Complexity) lies in AST.toRegExpSource() at src/ast.ts#L598, where the * extglob type emits a close token of )*, wrapping the recursive body in (?:...)*. Each level of nesting adds another * quantifier, producing textbook nested-quantifier patterns such as (?:(?:(?:a|b)*)*)* for a depth-3 pattern. Against a non-matching input of repeated characters followed by a terminator (e.g., 'a'.repeat(19) + 'z'), V8's backtracking engine explores an exponential number of paths before returning false. The vulnerability is triggered by the default minimatch() API with no special options required, and the minimum viable attack pattern is only 12 bytes (*(*(*(a|b)))). A public PoC demonstrating both standalone timing and HTTP event-loop starvation is available in the security advisory (Github Advisory).

Successful exploitation causes a denial of service by stalling the Node.js event loop, blocking all concurrent request processing for the duration of the backtracking computation. A 12-byte pattern with an 18-byte non-matching input stalls processing for over 7 seconds; adding one nesting level or a few input characters extends this to minutes. In a server context, a single malicious request can block all other requests from being served until the attack completes, effectively taking the application offline. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting any application that processes attacker-controlled glob patterns (Github Advisory).

A public proof-of-concept exploit is available in the GitHub security advisory, including both a standalone timing script and an HTTP server event-loop starvation demonstration. No authentication or special privileges are required to exploit the vulnerability — it is triggered via the default minimatch() API. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.04% (0.000400), indicating low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Red Hat Bugzilla).

1. Identify attack surface: Locate applications that use a vulnerable version of minimatch (< 3.1.4, 4.x < 4.2.5, 5.x < 5.1.8, 6.x < 6.2.2, 7.x < 7.4.8, 8.x < 8.0.6, 9.x < 9.0.7, 10.x < 10.2.3) and accept user-controlled glob patterns — such as build tools, CI/CD pipelines, multi-tenant platforms with file filter configuration, or any API endpoint that passes user input to minimatch().
2. Craft the malicious pattern: Construct a nested extglob pattern such as *(*(*(a|b))) (12 bytes, depth 3) or deeper nesting for greater impact. The +() extglob variant (e.g., +(+(+(a|b)))) is equally effective.
3. Craft the non-matching input: Prepare an input string of repeated characters followed by a non-matching character, e.g., 'a'.repeat(19) + 'z' (20 bytes). Longer inputs or deeper nesting exponentially increase stall duration.
4. Submit the payload: Send the malicious pattern and input to the target application via the available interface (e.g., HTTP query parameter, JSON body, configuration file, CLI argument). Example HTTP request: curl "http://target/match?pattern=*%28*%28*%28a%7Cb%29%29%29&path=aaaaaaaaaaaaaaaaaaaz"
5. Achieve denial of service: The Node.js event loop stalls for 7+ seconds (cold server: ~64 seconds) per request, blocking all concurrent legitimate requests until the backtracking completes. Repeated requests compound the effect (Github Advisory).

• Network: Unusual HTTP requests containing URL-encoded extglob patterns such as *%28*%28*%28 or %2B%28%2B%28%2B%28 in query parameters or request bodies targeting endpoints that perform glob matching.
• Logs: Application or web server logs showing requests with patterns containing nested *() or +() extglobs (e.g., *(*(*(a|b)))); unusually long request processing times (7+ seconds) for specific endpoints that use minimatch.
• Process: Node.js process CPU usage spiking to 100% for extended periods (seconds to minutes) on a single core; event loop lag metrics showing sustained high latency; other requests queuing or timing out during the spike.
• Application Metrics: Sudden increase in request timeout errors or 503 responses coinciding with specific pattern-matching requests; monitoring alerts for event loop delay exceeding normal thresholds (Github Advisory).

Upgrade minimatch to one of the patched versions corresponding to your current version line: 3.1.4, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, or 10.2.3. As an immediate workaround, pass { noext: true } to minimatch() calls when handling untrusted patterns — this disables extglob processing entirely and reduces processing time to ~0ms for the same inputs. Additionally, implement input validation to reject or sanitize glob patterns before processing, and consider adding timeout mechanisms for minimatch operations. Red Hat has issued multiple errata (RHSA-2026:6277, RHSA-2026:7080, RHSA-2026:7123, RHSA-2026:7302, and others) addressing this in Node.js packages across RHEL 8, 9, 10, and related products (Github Advisory, Red Hat Bugzilla).

Socket.dev published a blog post covering the three high-severity ReDoS vulnerabilities patched in minimatch, highlighting CVE-2026-27904 as the most severe due to its triggering via the default API with no special options (Socket Blog). IBM issued numerous security bulletins addressing the vulnerability across a wide range of products including Maximo Application Suite, Cloud Pak for Business Automation, IBM Db2 Big SQL, Guardium Data Security Center, watsonx Orchestrate, and others, reflecting the broad reach of the minimatch dependency in enterprise software. Red Hat responded with multiple errata across RHEL 8, 9, 10, Ansible Automation Platform, and JBoss EAP. The vulnerability was also noted in the LLVM project issue tracker and picked up by downstream Linux distribution security advisories for Rocky Linux and AlmaLinux.