CVE-2026-112366Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

Descripción

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/micromatch/picomatch/pull/194 patchissue-tracking
• https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307 technical-description
• VulnCheck Advisory: Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns third-party-advisory