[Pkg-javascript-devel] Bug#1153602: node-glob: CVE-2026-118773

[Moritz Mühlenhoff]

Source: node-glob
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for node-glob.

CVE-2026-118773[0]:
| Glob matches files using patterns the shell uses. From 9.0.0 until
| 14.0.2, abort branches in src/walker.ts, including
| GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and
| GlobUtil.walkCB2Sync(), invoke the callbacks without returning.
| After AbortSignal or AbortSignal.timeout() rejects or emits an
| error, execution can continue into processor.processPatterns(),
| readdirCB(), and recursive traversal. The issue affects glob() and
| globStream() when applications expose attacker-influenced patterns
| or directory trees and rely on cancellation as a traversal budget.
| Repeated timed-out requests can stack background filesystem
| operations and CPU work, degrading worker throughput or service
| availability; no confidentiality or integrity impact was observed.
| This issue is fixed in 14.0.2.

https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4

Fixed by: https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7 (v14.0.2)
			 

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-118773
    https://www.cve.org/CVERecord?id=CVE-2026-118773

Please adjust the affected versions in the BTS as needed.