Threats affecting pkg:npm/picomatch

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

CVE-2026-33672 is a prototype pollution vulnerability in the JavaScript glob matching library picomatch affecting versions prior to 4.0.4, 3.0.2, and 2.3.2. The vulnerability arises from improper handling of POSIX bracket expressions that can reference inherited Object.prototype methods, leading to incorrect glob matching behavior. This can cause security-relevant logic errors in applications relying on picomatch for filtering, validation, or access control.

Picomatch versions prior to 4.0.4, 3.0.2, and 2.3.2 contain a Regular Expression Denial of Service (ReDoS) vulnerability due to inefficient handling of certain extglob patterns. Crafted patterns using quantifiers like +() and *(), especially with nested or overlapping extglobs, can cause catastrophic backtracking, leading to excessive CPU usage and blocking the Node.js event loop. This results in a denial of service condition when untrusted user input is processed.