Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118773— Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

Quick assessment

Affected
isaacs node-glob
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Glob 使用与 Shell 相同的模式来匹配文件。在版本 9.0.0 到 14.0.2 期间， 中的中止分支（包括 、 、 和 ）在调用回调函数后并未正确返回。当 或 被拒绝或抛出错误后，执行流程仍可能继续进入 、 以及递归遍历逻辑。 该问题会影响 和 函数，当应用程序暴露了由攻击者控制的模式或目录树，并依赖取消机制来限制遍历预算时。重复的超时请求可能导致后台文件系统操作和 CPU 工作不断堆积，从而降低工作线程的吞吐量或影响服务的可用性；目前未观察到对机密性或完整性的影响。此问题已在 14.0.2 版本中修复。

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
isaacs node-glob >= 9.0.0, < 14.0.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118773

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
Source: CVE Program / CVE List V5
Vulnerability Description
Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
isaacs node-glob >= 9.0.0, < 14.0.2 -

II. Public POCs for CVE-2026-118773

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118773

请登录查看更多情报信息。

Other References for CVE-2026-118773 (3)

IV. Related Vulnerabilities

Same product: node-glob
Same vendor: isaacs
Same weakness: CWE-400