Threat database

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

### Withdrawn Advisory This advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references. ### Original Description braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

CVE-2026-33672 is a prototype pollution vulnerability in the JavaScript glob matching library picomatch affecting versions prior to 4.0.4, 3.0.2, and 2.3.2. The vulnerability arises from improper handling of POSIX bracket expressions that can reference inherited Object.prototype methods, leading to incorrect glob matching behavior. This can cause security-relevant logic errors in applications relying on picomatch for filtering, validation, or access control.

Picomatch versions prior to 4.0.4, 3.0.2, and 2.3.2 contain a Regular Expression Denial of Service (ReDoS) vulnerability due to inefficient handling of certain extglob patterns. Crafted patterns using quantifiers like +() and *(), especially with nested or overlapping extglobs, can cause catastrophic backtracking, leading to excessive CPU usage and blocking the Node.js event loop. This results in a denial of service condition when untrusted user input is processed.