Is CVE-2026-26996 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-26996, but active exploitation has not been confirmed.

Can CVE-2026-26996 be exploited remotely?

Yes. CVE-2026-26996 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26996?

CVE-2026-26996 has a CVSS score of 7.5 (HIGH) and an EPSS exploitation probability of 0.05%.

HOME VULNERABILITIESCVE-2026-26996

HIGHPOC

CVE-2026-26996

CWE-1333Published: February 20, 2026· Updated: Feb 20, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.1th

Official Description

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

NVD Source

Technical Analysis

CVE-2026-26996 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.

A proof-of-concept (PoC) exploit exists for CVE-2026-26996. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.