CVE-2026-118773 with a CVSS score of 6.3 is a resource exhaustion vulnerability in the glob npm package, specifically in the asynchronous directory-walking logic used by glob() and globStream(). It affects glob (npm) versions >= 9.0.0, <= 14.0.1. The flaw occurs because abort branches in the walker call the callback when an AbortSignal is already aborted but fail to return, so execution continues after the operation has rejected or emitted an error. An attacker can exploit this over a network with low complexity by supplying an attacker-influenced glob pattern or causing traversal of an attacker-controlled directory tree in an application that uses AbortSignal or AbortSignal.timeout() to bound traversal cost. The attacker does not need prior authentication or user interaction. After the request is canceled or times out, the walker keeps performing filesystem reads and recursive processing, consuming CPU and I/O. Repeated timed-out or canceled requests can stack background walks, degrade worker throughput, and reduce service availability. No confidentiality or integrity impact was observed.
We recommend you to update glob to version 14.0.2.[/subscribe_to_unlock_form]
CVE-2026-118773 with a CVSS score of 6.3 is a resource exhaustion vulnerability in the glob npm package, specifically in the asynchronous directory-walking logic used by glob() and globStream(). It affects glob (npm) versions >= 9.0.0, <= 14.0.1. The flaw occurs because abort branches in the walker call the callback when an AbortSignal is already aborted but fail to return, so execution continues after the operation has rejected or emitted an error. An attacker can exploit this over a network with low complexity by supplying an attacker-influenced glob pattern or causing traversal of an attacker-controlled directory tree in an application that uses AbortSignal or AbortSignal.timeout() to bound traversal cost. The attacker does not need prior authentication or user interaction. After the request is canceled or times out, the walker keeps performing filesystem reads and recursive processing, consuming CPU and I/O. Repeated timed-out or canceled requests can stack background walks, degrade worker throughput, and reduce service availability. No confidentiality or integrity impact was observed.
We recommend you to update glob to version 14.0.2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]