picomatch vulnerabilities

2 known vulnerabilities in picomatch from Micromatch. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  picomatch: Inefficient Regular Expression Complexity

  CVE-2026-112366Oct 19, 2026Micromatch

  Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtgl

• 7.5 High severity

  picomatch: Inefficient Regular Expression Complexity

  CVE-2026-33671Mar 26, 2026Micromatch

  Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()