CVE catalog

CVE-2026-26996

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a

[CVE catalog]

Severity
High · CVSS 8.7
Published
Source
[NVD] · [CVE record]
EPSS
0.58% · Oct 25, 2026

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-minimatchsid9.0.7-2fixed
Debiannode-minimatchforky9.0.7-2fixed
Debiannode-minimatchtrixie9.0.3-6vulnerable
Debiannode-minimatchbookworm5.1.1+~5.1.2-1vulnerable
Cpenode-minimatchNot reportedNot reportedvulnerable
CpeminimatchNot reportedNot reportedunknown
NpmminimatchNot reported3.1.3fixed
NpmminimatchNot reported9.0.6fixed
NpmminimatchNot reported8.0.5fixed
NpmminimatchNot reported7.4.7fixed
NpmminimatchNot reported6.2.1fixed
NpmminimatchNot reported5.1.7fixed
NpmminimatchNot reported4.2.4fixed
NpmminimatchNot reported3.1.3fixed
OpensuseopenQAleap 16.05.1783076943.6691832d-bp160.1.1fixed
Opensuseos-autoinstleap 16.05.1783082953.c3cb41d-bp160.1.1fixed
OpensuseopenQAtumbleweed5.1782995932.ffeb09be-1.1fixed
Susecockpit-subscriptionslinux enterprise server 16.012.1-160000.3.1fixed
Susecockpit-subscriptionslinux enterprise server for sap applications 16.012.1-160000.3.1fixed
Susecockpit-packageslinux enterprise server 16.04-160000.1.1fixed
Susecockpit-packageslinux enterprise server for sap applications 16.04-160000.1.1fixed
Opensusecockpit-subscriptionsleap 16.012.1-160000.3.1fixed
Susecockpit-subscriptionslinux micro 6.212.1-160000.3.1fixed
Opensusecockpit-reposleap 16.04.7-160000.2.1fixed
Susecockpit-reposlinux enterprise server 16.04.7-160000.2.1fixed
Susecockpit-reposlinux enterprise server for sap applications 16.04.7-160000.2.1fixed
Opensusecockpit-packagesleap 16.04-160000.1.1fixed
Susecockpit-reposlinux micro 6.24.7-160000.2.1fixed
Susecockpit-reposlinux micro 6.24.7-160000.2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-minimatchsourcesid9.0.7-1not yet assignedNot reported[1128579]
Debiannode-minimatchsourceforky9.0.7-1not yet assignedNot reported[1128579]
Debiannode-minimatchsourcetrixie(unfixed)not yet assignedNot reported[1128579]
Debiannode-minimatchsourcebookworm(unfixed)not yet assignedNot reported[1128579]
NpmminimatchnpmNot reported3.1.3Not reportedGHSA-3PPC-4F35-3M26Not reported
NpmminimatchnpmNot reported9.0.6Not reportedNot reportedNot reported
NpmminimatchnpmNot reported8.0.5Not reportedNot reportedNot reported
NpmminimatchnpmNot reported7.4.7Not reportedNot reportedNot reported
NpmminimatchnpmNot reported6.2.1Not reportedNot reportedNot reported
NpmminimatchnpmNot reported5.1.7Not reportedNot reportedNot reported
NpmminimatchnpmNot reported4.2.4Not reportedNot reportedNot reported
NpmminimatchnpmNot reported3.1.3Not reportedNot reportedNot reported
OpensuseopenQArpmleap 16.05.1783076943.6691832d-bp160.1.1Not reportedOPENSUSE-SU-2026:21266-1Not reported
Opensuseos-autoinstrpmleap 16.05.1783082953.c3cb41d-bp160.1.1Not reportedOPENSUSE-SU-2026:21266-1Not reported
OpensuseopenQArpmtumbleweed5.1782995932.ffeb09be-1.1Not reportedOPENSUSE-SU-2026:11178-1Not reported
Susecockpit-subscriptionsrpmlinux enterprise server 16.012.1-160000.3.1Not reportedSUSE-SU-2026:21191-1Not reported
Susecockpit-subscriptionsrpmlinux enterprise server for sap applications 16.012.1-160000.3.1Not reportedSUSE-SU-2026:21191-1Not reported
Susecockpit-packagesrpmlinux enterprise server 16.04-160000.1.1Not reportedSUSE-SU-2026:21141-1Not reported
Susecockpit-packagesrpmlinux enterprise server for sap applications 16.04-160000.1.1Not reportedSUSE-SU-2026:21141-1Not reported
Opensusecockpit-subscriptionsrpmleap 16.012.1-160000.3.1Not reportedOPENSUSE-SU-2026:20532-1Not reported
Susecockpit-subscriptionsrpmlinux micro 6.212.1-160000.3.1Not reportedSUSE-SU-2026:21111-1Not reported
Opensusecockpit-reposrpmleap 16.04.7-160000.2.1Not reportedOPENSUSE-SU-2026:20464-1Not reported
Susecockpit-reposrpmlinux enterprise server 16.04.7-160000.2.1Not reportedSUSE-SU-2026:20997-1Not reported
Susecockpit-reposrpmlinux enterprise server for sap applications 16.04.7-160000.2.1Not reportedSUSE-SU-2026:20997-1Not reported
Opensusecockpit-packagesrpmleap 16.04-160000.1.1Not reportedOPENSUSE-SU-2026:20469-1Not reported
Susecockpit-reposrpmlinux micro 6.24.7-160000.2.1Not reportedSUSE-SU-2026:20973-1Not reported
Susecockpit-reposrpmlinux micro 6.24.7-160000.2.1Not reportedSUSE-SU-2026:20967-1Not reported

[Debian bug #1128579]

Notes

[trixie] node-minimatch: Minor issue [bookworm] node-minimatch: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-minimatch]Affected
    Details (2)

    • 5.1.1+~5.1.2-1 · all · bookworm

      Affected

      nvd · node-minimatch · debian · bookworm; nvd · node-minimatch · debian · 12

    • 5.1.1+~5.1.2-1 · all · bookworm

      Affected

      nvd · node-minimatch · debian · bookworm; nvd · node-minimatch · debian · 12

[Debian 13 (Trixie)]

  • [node-minimatch]Affected
    Details (2)

    • 9.0.3-6 · all · trixie

      Affected

      nvd · node-minimatch · debian · 13

    • 9.0.3-6 · all · trixie

      Affected

      nvd · node-minimatch · debian · 13

[openSUSE Tumbleweed]

  • [openQA-auto-update]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-bootstrap]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-client]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-client-bash-completion]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-client-zsh-completion]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-common]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-continuous-update]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-devel]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-doc]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-llm-server]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-local-db]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-mcp]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-munin]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-python-scripts]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-single-instance]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-single-instance-nginx]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA-worker]Unknown

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.1782995932.ffeb09be-1.1

      Version impact unknown

      nvd · openQA · opensuse · tumbleweed

  • [openQA]Fixed

    Source package: [openQA]

    Details (1)

    • 5.1787055821.5de28100-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 5.1782995932.ffeb09be-1.1

      nvd · openQA · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]