CVE-2026-112366Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

Beschreibung

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://github.com/micromatch/picomatch/pull/194 patchissue-tracking
• https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307 technical-description
• VulnCheck Advisory: Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns third-party-advisory