{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T22:34:28.134","vulnerabilities":[{"cve":{"id":"CVE-2026-27904","sourceIdentifier":"security-advisories@github.com","published":"2026-02-26T02:16:21.760","lastModified":"2026-02-27T17:16:23.773","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue."},{"lang":"es","value":"minimatch es una utilidad de coincidencia mínima para convertir expresiones glob en objetos RegExp de JavaScript. Antes de las versiones 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5 y 3.1.4, los extglobs anidados '*( )' producen regexps con cuantificadores anidados ilimitados (por ejemplo, '(?:(?:a|b)*)*'), que exhiben retroceso catastrófico en V8. Con un patrón de 12 bytes '*(*(*(a|b)))' y una entrada no coincidente de 18 bytes, 'minimatch()' se detiene durante más de 7 segundos. Añadir un solo nivel de anidamiento o unos pocos caracteres de entrada eleva esto a minutos. Este es el hallazgo más grave: se activa por la API predeterminada de 'minimatch()' sin opciones especiales, y el patrón mínimo viable es de solo 12 bytes. El mismo problema afecta a los extglobs '+()' por igual. Las versiones 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5 y 3.1.4 solucionan el problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.1.4","matchCriteriaId":"41106C86-4D1E-40C7-851F-2564462205C3"},{"vulnerable":true,"criteria":"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.2.5","matchCriteriaId":"39C23B15-E8E5-4847-A6EF-0940FA9F26BF"},{"vulnerable":true,"criteria":"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.1.8","matchCriteriaId":"DA03D53D-D7C4-424A-A3BA-C8C3B90D3EA2"},{"vulnerable":true,"criteria":"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.2.2","matchCriteriaId":"B3677470-9515-47D2-B5FB-4FA1F700ED55"},{"vulnerable":true,"criteria":"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.4.8","matchCriteriaId":"A34E360D-31EA-43CF-957E-5D2208076EBF"},{"vulnerable":true,"criteria":"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.6","matchCriteriaId":"6391D830-3745-4C96-A6CF-A6C75CC221A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.7","matchCriteriaId":"3E6BE4CC-B5A1-4FC8-8776-9BEA2B10F6D7"},{"vulnerable":true,"criteria":"cpe:2.3:a:minimatch_project:minimatch:*:*:*:*:*:node.js:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.2.3","matchCriteriaId":"5B5B4C6E-7FBB-4C95-BD32-B3A16C6B1E5B"}]}]}],"references":[{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}