high7.5
CVE-2026-112366
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch …
Impact
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
Affected products
| Product | Affected versions |
|---|---|
| Picomatch | through 4.0.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.