picomatch: Regular expression denial of service via repeated extglob patterns
Summary
picomatch, a JavaScript glob matching library, contains a ReDoS vulnerability in versions through 4.0.7. Supplying single-branch repeated extglob patterns such as +(*) or +(*a) causes exponential backtracking on short crafted strings, which can block the Node.js event loop. Exploitation requires that an attacker can supply glob patterns to an application using picomatch.
Affected
- picomatch 0 through 4.0.7 (per CVE record; default configuration)
- Transitive copies in Node.js applications and build tooling
Fixed in
Unknown. No fixed version has been published at the time of writing.
Workaround
- Do not pass untrusted glob patterns to picomatch.
- Use noextglob: true for untrusted input.
- Reject or sanitise patterns containing extglob quantifiers.
- Run pattern matching in an isolated worker or process with time and resource limits.
Exploitation
- No known exploitation in the wild.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept found.
Our recommendation
- Inventory all picomatch versions in production and CI, including transitive dependencies, using lockfiles or SCA tools.
- Identify code paths where external users can supply glob patterns and treat them as the priority.
- Apply the interim mitigations and test them in staging first.
- Monitor the upstream issue and the NVD entry, and upgrade once a verified fixed release is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- picomatch parse.js at 4.0.7 github.com
- picomatch upstream issue 234 github.com
- Snyk advisory SNYK-JS-PICOMATCH-21248802 security.snyk.io
- GitHub Advisory GHSA-fc5q-39xc-vjpf github.com
- Ubuntu CVE record ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:03.
Original description (NVD)
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.