Picomatch is a JavaScript glob matcher vulnerable to a Regular Expression Denial of Service (ReDoS) in versions before 4.0.4, 3.0.2, and 2.3.2. The issue arises when certain crafted extglob patterns with quantifiers such as +() and *(), particularly those with nested or overlapping alternatives, are compiled into regular expressions that cause catastrophic backtracking on non-matching input. This leads to excessive CPU consumption and blocks the Node.js event loop, causing denial of service. The vulnerability affects applications that accept untrusted glob patterns passed to picomatch. The issue has been addressed in the specified fixed versions. Mitigations include upgrading, disabling extglob for untrusted input, sanitizing patterns, enforcing allowlists, isolating matching in separate processes, and applying input validation and throttling.

An attacker can cause a denial of service by supplying crafted glob patterns that trigger catastrophic backtracking in picomatch's regular expression engine. This results in high CPU usage and blocks the Node.js event loop, potentially making the affected application unresponsive. There is no impact on confidentiality or integrity reported. The vulnerability is exploitable remotely without authentication if untrusted input is processed.

A fix is available in picomatch versions 4.0.4, 3.0.2, and 2.3.2. Users should upgrade to one of these versions or later according to their supported release line. If upgrading is not immediately feasible, avoid passing untrusted glob patterns to picomatch. Additional mitigations include disabling extglob support for untrusted input by setting 'noextglob: true', rejecting or sanitizing patterns containing nested extglobs or quantifiers like +() and *(), enforcing strict allowlists for accepted pattern syntax, running matching operations in isolated workers or separate processes with resource limits, and applying application-level request throttling and input validation on endpoints accepting glob patterns.