Homepage

Inefficient Regular Expression Complexity The advisory has been revoked - it doesn't affect any version of package nodejs24-npm  (opens in a new tab)

Threat Intelligence

EPSS
0.52% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-NODEJS24NPM-15324766
  • published21 Feb 2026
  • disclosed20 Feb 2026
Report a new vulnerability Found a mistake?

Introduced: 20 Feb 2026

CVE-2026-26996  (opens in a new tab)
CWE-1333  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs24-npm package and not the nodejs24-npm package as distributed by RHEL.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.