Live › vulnerability › CVE-2026-112366
Go to dashboardPicomatch through 4.0.7 mishandles repeated extglob patterns such as +(*) or +(*a), causing exponential regex backtracking on short strings. An attacker who can supply such a glob can block the Node.js event loop and deny service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run npm ls picomatch (and pnpm why picomatch) to find installed versions and whether any Node.js app passes user-supplied globs to picomatch.
4.0.7; the fixed version is unknown from the sources, so check the picomatch changelog or npmEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
This page as .md · .json · in your agent: get_signal("CVE-2026-112366")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.