CVE-2026-118773: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
globto a version that resolves this vulnerability.Fixed in 14.0.2
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using glob() or globStream() with versions from 9.0.0 through before 14.0.2 are exposed when they accept attacker-influenced glob patterns or directory trees and use AbortSignal or AbortSignal.timeout() to limit traversal work.
What does an attacker need to do to exploit it?
An attacker needs to cause glob traversal work against attacker-influenced patterns or directory trees and have the application’s cancellation limit trigger. The abort can be bypassed in affected paths, allowing traversal and filesystem operations to continue after the timeout or error.
Are confidentiality or integrity affected?
No confidentiality or integrity impact was observed. The documented impact is continued background filesystem and CPU work, which can degrade worker throughput or service availability when timed-out requests are repeated.
What is the remediation?
Update Glob to version 14.0.2, which fixes the issue. Until updating, do not rely on AbortSignal cancellation alone as a traversal budget for attacker-influenced patterns or directory trees.