CVE-2026-112366 — Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob p…
Published: 2026-10-19 · CVSS: 8.7 · CVSS 4.0
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7