Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck
CVE-2026-112366Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
High 7.5
In plain English
A high-severity regular-expression denial of service in picomatch from micromatch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-anymatch | no fix listed | DEBIAN-CVE-2026-112366 |
| Debian:13 | node-anymatch | no fix listed | DEBIAN-CVE-2026-112366 |
| Debian:14 | node-anymatch | no fix listed | DEBIAN-CVE-2026-112366 |
| Ubuntu:22.04:LTS | node-anymatch | no fix listed | UBUNTU-CVE-2026-112366 |
| Ubuntu:24.04:LTS | node-anymatch | no fix listed | UBUNTU-CVE-2026-112366 |
| Ubuntu:26.04:LTS | node-anymatch | no fix listed | UBUNTU-CVE-2026-112366 |
| Ubuntu:26.10 | node-anymatch | no fix listed | UBUNTU-CVE-2026-112366 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| micromatch | picomatch | 0 – through 4.0.7 |
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/micromatch/picomatch/pull/194 patch, issue-tracking
- https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307 technical-description
- VulnCheck Advisory: Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns third-party-advisory