CVE catalog
CVE-2026-27904
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extgl
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.53% · Oct 25, 2026
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-minimatch | sid | 9.0.7-2 | fixed |
| Debian | node-minimatch | forky | 9.0.7-2 | fixed |
| Debian | node-minimatch | trixie | 9.0.3-6 | vulnerable |
| Debian | node-minimatch | bookworm | 5.1.1+~5.1.2-1 | vulnerable |
| Cpe | node-minimatch | Not reported | Not reported | vulnerable |
| Npm | minimatch | Not reported | 3.1.4 | fixed |
| Npm | minimatch | Not reported | 9.0.7 | fixed |
| Npm | minimatch | Not reported | 8.0.6 | fixed |
| Npm | minimatch | Not reported | 7.4.8 | fixed |
| Npm | minimatch | Not reported | 6.2.2 | fixed |
| Npm | minimatch | Not reported | 5.1.8 | fixed |
| Npm | minimatch | Not reported | 4.2.5 | fixed |
| Npm | minimatch | Not reported | 3.1.4 | fixed |
| Npm | minimatch | Not reported | 10.2.3 | fixed |
| Npm | minimatch | Not reported | 9.0.7 | fixed |
| Npm | minimatch | Not reported | 8.0.6 | fixed |
| Npm | minimatch | Not reported | 7.4.8 | fixed |
| Npm | minimatch | Not reported | 6.2.2 | fixed |
| Npm | minimatch | Not reported | 5.1.8 | fixed |
| Npm | minimatch | Not reported | 4.2.5 | fixed |
| Npm | minimatch | Not reported | 3.1.4 | fixed |
| Opensuse | cockpit-subscriptions | tumbleweed | 16.3-1.1 | fixed |
| Opensuse | cockpit-repos | tumbleweed | 4.9-1.1 | fixed |
| Opensuse | onnxruntime | tumbleweed | 1.26.0-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-minimatch | source | sid | 9.0.7-1 | not yet assigned | Not reported | [1129095] |
| Debian | node-minimatch | source | forky | 9.0.7-1 | not yet assigned | Not reported | [1129095] |
| Debian | node-minimatch | source | trixie | (unfixed) | not yet assigned | Not reported | [1129095] |
| Debian | node-minimatch | source | bookworm | (unfixed) | not yet assigned | Not reported | [1129095] |
| Npm | minimatch | npm | Not reported | 3.1.4 | Not reported | GHSA-23C5-XMQV-RM74 | Not reported |
| Npm | minimatch | npm | Not reported | 9.0.7 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 8.0.6 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 7.4.8 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 6.2.2 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 5.1.8 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 4.2.5 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 3.1.4 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 10.2.3 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 9.0.7 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 8.0.6 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 7.4.8 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 6.2.2 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 5.1.8 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 4.2.5 | Not reported | Not reported | Not reported |
| Npm | minimatch | npm | Not reported | 3.1.4 | Not reported | Not reported | Not reported |
| Opensuse | cockpit-subscriptions | rpm | tumbleweed | 16.3-1.1 | Not reported | OPENSUSE-SU-2026:11447-1 | Not reported |
| Opensuse | cockpit-repos | rpm | tumbleweed | 4.9-1.1 | Not reported | OPENSUSE-SU-2026:11446-1 | Not reported |
| Opensuse | onnxruntime | rpm | tumbleweed | 1.26.0-1.1 | Not reported | OPENSUSE-SU-2026:11146-1 | Not reported |
Notes
[trixie] node-minimatch: Minor issue [bookworm] node-minimatch: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [node-minimatch]Affected
Details (2)
5.1.1+~5.1.2-1· all · bookwormAffected
nvd · node-minimatch · debian · bookworm; nvd · node-minimatch · debian · 12
5.1.1+~5.1.2-1· all · bookwormAffected
nvd · node-minimatch · debian · bookworm; nvd · node-minimatch · debian · 12
[Debian 13 (Trixie)]
- [node-minimatch]Affected
Details (2)
9.0.3-6· all · trixieAffected
nvd · node-minimatch · debian · 13
9.0.3-6· all · trixieAffected
nvd · node-minimatch · debian · 13
[openSUSE Tumbleweed]
- [libonnxruntime1]Unknown
Source package: [onnxruntime]
Details (1)
1.27.0-2.1· x86_64 · tumbleweedUnknown · Fixed:
1.26.0-1.1Version impact unknown
nvd · onnxruntime · opensuse · tumbleweed
- [onnxruntime-devel]Unknown
Source package: [onnxruntime]
Details (1)
1.27.0-2.1· x86_64 · tumbleweedUnknown · Fixed:
1.26.0-1.1Version impact unknown
nvd · onnxruntime · opensuse · tumbleweed
- [python313-onnxruntime]Unknown
Source package: [onnxruntime]
Details (1)
1.27.0-2.1· x86_64 · tumbleweedUnknown · Fixed:
1.26.0-1.1Version impact unknown
nvd · onnxruntime · opensuse · tumbleweed
- [python314-onnxruntime]Unknown
Source package: [onnxruntime]
Details (1)
1.27.0-2.1· x86_64 · tumbleweedUnknown · Fixed:
1.26.0-1.1Version impact unknown
nvd · onnxruntime · opensuse · tumbleweed
- [cockpit-repos]Fixed
Source package: [cockpit-repos]
Details (1)
4.9-1.1· noarch · tumbleweedFixed · Fixed:
4.9-1.1nvd · cockpit-repos · opensuse · tumbleweed
- [cockpit-subscriptions]Fixed
Source package: [cockpit-subscriptions]
Details (1)
16.3-1.1· noarch · tumbleweedFixed · Fixed:
16.3-1.1nvd · cockpit-subscriptions · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11126-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-27904]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-27904]
- [https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11146-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11446-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11447-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-27904]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27904.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0752.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]