CVE-2026-112366: Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +() or +(a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Node.js applications using npm/picomatch through 4.0.7 are exposed when an attacker can supply or influence glob patterns that the application passes to Picomatch. The impact is blocking the Node.js event loop, resulting in denial of service.
What does an attacker need to exploit it?
No authentication or user interaction is required. The attacker needs a path to provide a crafted single-branch repeated extglob pattern, such as +(*) or +(*a), along with input that triggers exponential regular-expression backtracking.
How can I determine whether my application is affected?
Check whether your dependency tree includes picomatch version 4.0.7 or earlier, and identify code paths that process externally influenced glob patterns. Patterns using repeated extglobs with a single branch, including +(*) and +(*a), are relevant indicators.