CVE-2026-112366
CVE-2026-112366 · Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
CVSS 8.7 · High · EPSS 0.3%
- Published
- Updated
Stack: system
Affected products and versions
picomatch
- Versions
- ≥ 0, ≤ 4.0.7: Affected (semver)
No fix published
node-anymatch Debian:12
- Versions
- 3.1.3+~cs4.6.1-2
- 3.1.3+~cs8.0.5-1
- 3.1.3+~cs8.0.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-anymatch Debian:13
- Versions
- 3.1.3+~cs4.6.1-2
- 3.1.3+~cs8.0.5-1
- 3.1.3+~cs8.0.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-anymatch Debian:14
- Versions
- 3.1.3+~cs4.6.1-2
- 3.1.3+~cs8.0.5-1
- 3.1.3+~cs8.0.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-anymatch Ubuntu:18.04:LTS
- Versions
- 1.3.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-anymatch Ubuntu:20.04:LTS
- Versions
- 3.0.3+~2.0.7-3
- 3.1.1+~2.1.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-anymatch Ubuntu:22.04:LTS
- Versions
- 3.1.1+~2.2.2-1
- 3.1.2+~cs4.5.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-anymatch Ubuntu:24.04:LTS
- Versions
- 3.1.3+~cs4.6.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-anymatch Ubuntu:26.10
- Versions
- 3.1.3+~cs8.0.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-anymatch Ubuntu:26.04:LTS
- Versions
- 3.1.3+~cs4.6.1-2
- 3.1.3+~cs8.0.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published