minimatch 存在模式中重复通配符与不匹配的字面量导致的 ReDoS 问题

The ReDoS vulnerability in minimatch arises from the use of excessive ` wildcards in glob patterns. When a pattern containing many consecutive characters is matched against a string that doesn't contain the expected literal character, the V8 regex engine performs exponential backtracking. This backtracking process consumes significant CPU resources, potentially freezing the Node.js process or causing it to crash. The time complexity of the vulnerability is O(4^N), where N is the number of characters. A pattern with 15 characters can take 2 seconds to process, while a pattern with 34 *` characters can effectively hang the system. This makes it possible to remotely cause a DoS condition by crafting malicious glob patterns.

Node.js projects that rely on the minimatch package for glob pattern matching are at risk. This includes projects using file system watchers, build tools, and any application that processes user-supplied file paths or patterns. Projects using older versions of Node.js that may have transitive dependencies on vulnerable versions of minimatch are also at risk.

• nodejs / server:

  npm list minimatch

This command will list the installed version of minimatch. If the version is less than 10.2.1, the system is vulnerable. • nodejs / server:

  grep -r 'minimatch.match' ./node_modules/minimatch/

This command searches for the vulnerable match function within the minimatch module's source code. While not a direct indicator of exploitation, it can help confirm the presence of the vulnerable version. • nodejs / server:

  ps aux | grep -E 'node.*minimatch'

This command searches for Node.js processes that are using the minimatch package. Monitor CPU usage of these processes for signs of excessive backtracking.

1. 2026-02-18Disclosure

   disclosure

最后更新

10.2.5最近

1. 已保留2026-02-17
2. 发布日期2026-02-18
3. 修改日期2026-02-24
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-26996 is to upgrade the minimatch package to version 10.2.1 or later. This version includes a fix that prevents the exponential backtracking behavior. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing input validation to restrict the complexity of glob patterns used in your application. While not a complete solution, this can reduce the attack surface. Monitor CPU usage and Node.js process health for signs of excessive backtracking. There are no specific WAF rules or detection signatures readily available for this specific ReDoS vulnerability, but general ReDoS detection rules might provide some protection.