CVE-2026-118773: CVE-2026-118773: Asynchronous Control Flow Bypass and Uncontrolled Resource Consumption in node-glob
CVE-2026-118773: Asynchronous Control Flow Bypass and Uncontrolled Resource Consumption in node-glob Vulnerability ID: CVE-2026-118773 CVSS Score: 6.3 Published: 2026-10-30 CVE-2026-118773 (GHSA-3g3m-2fjr-6pw4) is an uncontrolled resource consumption vulnerability in the node-glob npm package affecting versions 9.0.0 through 14.0.1. Due to missing return statements in the AbortSignal check…
CVE-2026-118773 is a vulnerability in the node-glob npm package, specifically affecting versions 9.0.0 through 14.0.1. The issue lies within the directory traversal walker routine, where missing return statements in the AbortSignal check logic allow aborted operations to continue executing background filesystem reads and pattern matching.
This can lead to CPU, event loop, and disk I/O exhaustion for applications that rely on AbortSignal or AbortSignal.timeout() to enforce execution budgets on user-influenced glob operations.
To resolve the issue, upgrading to glob version 14.0.2 is recommended, as it properly terminates the control flow upon signal abortion. The vulnerability has been classified as CWE-400 (Uncontrolled Resource Consumption) and has a CVSS v4.0 score of 6.3, indicating a medium severity level. The exploit status is currently a proof-of-concept (POC) with a technical reproduction in the unit test of patch commit 4682e8c.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
