Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2026-27904

Inefficient Regular Expression Complexity

Published: Feb 26, 2026 | Modified: Jun 17, 2026
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
6.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-27904
CWEhttps://cwe.mitre.org/data/definitions/1333.html

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Weakness

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Affected Software

NameVendorStart VersionEnd Version
MinimatchMinimatch_project*3.1.4 (excluding)
MinimatchMinimatch_project4.0.0 (including)4.2.5 (excluding)
MinimatchMinimatch_project5.0.0 (including)5.1.8 (excluding)
MinimatchMinimatch_project6.0.0 (including)6.2.2 (excluding)
MinimatchMinimatch_project7.0.0 (including)7.4.8 (excluding)
MinimatchMinimatch_project8.0.0 (including)8.0.6 (excluding)
MinimatchMinimatch_project9.0.0 (including)9.0.7 (excluding)
MinimatchMinimatch_project10.0.0 (including)10.2.3 (excluding)
Red Hat Ansible Automation Platform 2.5 for RHEL 8RedHatautomation-gateway-0:2.5.20260422-3.el8ap*
Red Hat Ansible Automation Platform 2.5 for RHEL 9RedHatautomation-gateway-0:2.5.20260422-3.el9ap*
Red Hat Ansible Automation Platform 2.6 for RHEL 9RedHatautomation-platform-ui-0:2.6.7-1.el9ap*
Red Hat Enterprise Linux 10RedHatnodejs22-1:22.22.2-1.el10_1*
Red Hat Enterprise Linux 10.0 Extended Update SupportRedHatnodejs22-1:22.22.2-2.el10_0*
Red Hat Enterprise Linux 8RedHatnodejs:22-8100020260331102257.6d880403*
Red Hat Enterprise Linux 8RedHatnodejs:20-8100020260414073138.489197e6*
Red Hat Enterprise Linux 9RedHatnodejs:22-9070020260401095228.rhel9*
Red Hat Enterprise Linux 9RedHatnodejs:20-9070020260409073121.rhel9*
Red Hat Enterprise Linux 9.4 Extended Update SupportRedHatnodejs:20-9040020260421133644.rhel9*
Red Hat Enterprise Linux 9.6 Extended Update SupportRedHatnodejs:22-9060020260409121057.rhel9*
Red Hat Enterprise Linux 9.6 Extended Update SupportRedHatnodejs:20-9060020260422064119.rhel9*
Red Hat JBoss Enterprise Application Platform 8.1RedHatio.hawt-project*
Red Hat JBoss Enterprise Application Platform 8.1RedHatorg.keycloak-keycloak-parent*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8RedHateap8-hal-console-0:3.7.19-1.Final_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9RedHateap8-hal-console-0:3.7.19-1.Final_redhat_00001.1.el9eap*
Red Hat Developer Hub 1.8RedHatrhdh/rhdh-hub-rhel9:1776784286*
Red Hat Developer Hub 1.9RedHatrhdh/rhdh-hub-rhel9:1777903262*
Red Hat OpenShift AI 2.25RedHatrhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1776257621*
Red Hat OpenShift AI 2.25RedHatrhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9:1776413275*
Red Hat OpenShift AI 2.25RedHatrhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1776336652*
Red Hat OpenShift AI 2.25RedHatrhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1776319193*
Red Hat OpenShift AI 2.25RedHatrhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9:1776319213*
Red Hat OpenShift AI 2.25RedHatrhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1776319275*
Red Hat Openshift Data Foundation 4.18RedHatodf4/cephcsi-rhel9:1783676191*
Red Hat Openshift Data Foundation 4.18RedHatodf4/cephcsi-rhel9-operator:1783929816*
Red Hat Openshift Data Foundation 4.18RedHatodf4/mcg-core-rhel9:1784094353*
Red Hat Openshift Data Foundation 4.18RedHatodf4/mcg-rhel9-operator:1784093953*
Red Hat Openshift Data Foundation 4.18RedHatodf4/ocs-client-console-rhel9:1784094943*
Red Hat Openshift Data Foundation 4.18RedHatodf4/ocs-client-rhel9-operator:1783676585*
Red Hat Openshift Data Foundation 4.18RedHatodf4/ocs-metrics-exporter-rhel9:1783676649*
Red Hat Openshift Data Foundation 4.18RedHatodf4/ocs-rhel9-operator:1783676675*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odf-cli-rhel9:1784094299*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odf-console-rhel9:1784094725*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odf-cosi-sidecar-rhel9:1783676820*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odf-csi-addons-rhel9-operator:1783676883*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odf-csi-addons-sidecar-rhel9:1783676894*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odf-multicluster-console-rhel9:1784095175*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odf-multicluster-rhel9-operator:1783676977*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odf-must-gather-rhel9:1784093503*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odf-rhel9-operator:1783677297*
Red Hat Openshift Data Foundation 4.18RedHatodf4/odr-rhel9-operator:1783677345*
Red Hat Openshift Data Foundation 4.18RedHatodf4/rook-ceph-rhel9-operator:1783677533*
Red Hat Openshift Data Foundation 4.19RedHatodf4/cephcsi-rhel9:1783684360*
Red Hat Openshift Data Foundation 4.19RedHatodf4/cephcsi-rhel9-operator:1783684068*
Red Hat Openshift Data Foundation 4.19RedHatodf4/mcg-core-rhel9:1784054582*
Red Hat Openshift Data Foundation 4.19RedHatodf4/mcg-rhel9-operator:1784054606*
Red Hat Openshift Data Foundation 4.19RedHatodf4/ocs-client-console-rhel9:1784055295*
Red Hat Openshift Data Foundation 4.19RedHatodf4/ocs-client-rhel9-operator:1783684603*
Red Hat Openshift Data Foundation 4.19RedHatodf4/ocs-metrics-exporter-rhel9:1783684668*
Red Hat Openshift Data Foundation 4.19RedHatodf4/ocs-rhel9-operator:1783684667*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-cli-rhel9:1784054873*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-cloudnative-pg-rhel9-operator:1783684707*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-console-rhel9:1784055589*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-cosi-sidecar-rhel9:1783684779*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-csi-addons-rhel9-operator:1783684831*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-csi-addons-sidecar-rhel9:1783684839*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-multicluster-console-rhel9:1784055533*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-multicluster-rhel9-operator:1784055558*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-must-gather-rhel9:1784056134*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odf-rhel9-operator:1783685128*
Red Hat Openshift Data Foundation 4.19RedHatodf4/odr-rhel9-operator:1783685129*
Red Hat Openshift Data Foundation 4.19RedHatodf4/rook-ceph-rhel9-operator:1783685375*
Red Hat Openshift Data Foundation 4.2RedHatodf4/cephcsi-rhel9:1783667125*
Red Hat Openshift Data Foundation 4.2RedHatodf4/cephcsi-rhel9-operator:1783666755*
Red Hat Openshift Data Foundation 4.2RedHatodf4/mcg-core-rhel9:1784054598*
Red Hat Openshift Data Foundation 4.2RedHatodf4/mcg-rhel9-operator:1784055387*
Red Hat Openshift Data Foundation 4.2RedHatodf4/ocs-client-console-rhel9:1784055726*
Red Hat Openshift Data Foundation 4.2RedHatodf4/ocs-client-rhel9-operator:1783667517*
Red Hat Openshift Data Foundation 4.2RedHatodf4/ocs-metrics-exporter-rhel9:1783667577*
Red Hat Openshift Data Foundation 4.2RedHatodf4/ocs-rhel9-operator:1783667611*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-cli-rhel9:1784055020*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-cloudnative-pg-rhel9-operator:1783667641*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-console-rhel9:1784055586*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-cosi-sidecar-rhel9:1783667790*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-csi-addons-rhel9-operator:1783667859*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-csi-addons-sidecar-rhel9:1783667875*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-external-snapshotter-rhel9-operator:1783667869*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-external-snapshotter-sidecar-rhel9:1783667877*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-multicluster-console-rhel9:1784055576*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-multicluster-rhel9-operator:1784055244*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-must-gather-rhel9:1784055382*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odf-rhel9-operator:1783668266*
Red Hat Openshift Data Foundation 4.2RedHatodf4/odr-rhel9-operator:1783668288*
Red Hat Openshift Data Foundation 4.2RedHatodf4/rook-ceph-rhel9-operator:1783669219*
Red Hat OpenShift Dev Spaces 3.28RedHatdevspaces/code-rhel9:1779814592*
Red Hat OpenShift Dev Spaces 3.28RedHatdevspaces/openvsx-rhel9:1779528224*
Red Hat Quay 3.1RedHatquay/quay-rhel8:1773971077*
Red Hat Quay 3.12RedHatquay/quay-rhel8:1773771962*
Red Hat Quay 3.15RedHatquay/quay-rhel8:1775169219*
Red Hat Quay 3.16RedHatquay/quay-rhel9:1775069491*
Red Hat Quay 3.16RedHatquay/quay-rhel9:1775169226*
Red Hat Quay 3.9RedHatquay/quay-rhel8:1773936323*
Red Hat Satellite 6.18RedHatsatellite/iop-advisor-frontend-rhel9:1781181673*
Red Hat Satellite 6.18RedHatsatellite/iop-vulnerability-frontend-rhel9:1781032495*
Node-minimatchUbuntuesm-apps/xenial*
Node-minimatchUbuntuquesting*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use