{
  "id": 17368794,
  "title": "CVE-2026-118773: CVE-2026-118773: Asynchronous Control Flow Bypass and Uncontrolled Resource Consumption in node-glob",
  "url": "https://urgent.news/2026/10/31/cve-2026-118773-cve-2026-118773-asynchronous-control-flow-bypass-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-31T08:30:51.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/cve-2026-118773-cve-2026-118773-asynchronous-control-flow-bypass-and-uncontrolled-resource-kll"
  },
  "original_language": "en",
  "account": "CVE-2026-118773 is a vulnerability in the node-glob npm package, specifically affecting versions 9.0.0 through 14.0.1. The issue lies within the directory traversal walker routine, where missing return statements in the AbortSignal check logic allow aborted operations to continue executing background filesystem reads and pattern matching. This can lead to CPU, event loop, and disk I/O exhaustion for applications that rely on AbortSignal or AbortSignal.timeout() to enforce execution budgets on user-influenced glob operations.\n\nTo resolve the issue, upgrading to glob version 14.0.2 is recommended, as it properly terminates the control flow upon signal abortion. The vulnerability has been classified as CWE-400 (Uncontrolled Resource Consumption) and has a CVSS v4.0 score of 6.3, indicating a medium severity level. The exploit status is currently a proof-of-concept (POC) with a technical reproduction in the unit test of patch commit 4682e8c.",
  "summary": "CVE-2026-118773: Asynchronous Control Flow Bypass and Uncontrolled Resource Consumption in node-glob Vulnerability ID: CVE-2026-118773 CVSS Score: 6.3 Published: 2026-10-30 CVE-2026-118773 (GHSA-3g3m-2fjr-6pw4) is an uncontrolled resource consumption vulnerability in the node-glob npm package affecting versions 9.0.0 through 14.0.1. Due to missing return statements in the AbortSignal check…",
  "key_points": [
    "CVE-2026-118773 affects node-glob versions 9.0.0 to 14.0.1",
    "Missing return statements in AbortSignal check logic cause CPU, event loop, and disk I/O exhaustion",
    "Upgrading to glob version 14.0.2 resolves the issue"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}