Resource exhaustion in node-glob - CVE-2026-118773
Published: November 9, 2026
Vulnerability identifier: #VU163097
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118773
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to degrade service availability through filesystem I/O and CPU consumption after glob traversal is canceled.
The vulnerability exists due to cancellation handling in glob's directory walker failing to stop traversal when applications expose attacker-influenced patterns or directory trees and rely on AbortSignal to limit traversal costs. An unauthenticated remote attacker can submit repeated requests that time out but leave background walks running, reducing worker throughput.
Affected software
node-glob
How to mitigate CVE-2026-118773
Install security update from vendor's website.
node-glob - update to 14.0.2