CVE-2026-26996

CVE-2026-26996 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting minimatch versions 10.2.0 and below. This flaw allows an attacker to craft a malicious glob pattern with many consecutive wildcard characters, causing the application to consume excessive CPU resources and become unresponsive. The vulnerability has a CVSS score of 7.5 (High), indicating that it can be exploited remotely with low attack complexity, leading to a complete denial of service. There is currently no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules. The vulnerability has received minimal community discussion and no media coverage.