Node.js CVE-2026-33671
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious extglob pattern with nested quantifiers
-
ExploitSubmit pattern to picomatch parser
-
ExecutionTrigger catastrophic regex backtracking
-
ImpactExhaust CPU resources and block event loop
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker sends crafted extglob patterns (e.g., '+(a|aa)', '+(+(a))') to picomatch library processing user-controlled input. No special configuration required; affects default installations processing untrusted glob patterns. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-accessible attack with low complexity, requiring no privileges or user interaction, resulting in high availability impact. Real-world risk is significant for applications that accept untrusted glob patterns from users, such as web-based file browsers, API endpoints accepting search patterns, or multi-tenant platforms with user-defined filtering. The vulnerability is highly automatable given the straightforward exploitation (simply submit a malicious pattern), and the technical impact is a complete denial of service for the affected process. However, risk is substantially lower for applications using only developer-controlled patterns. The availability of working examples in the advisory (41-character inputs causing 2-second blocks, 33-character inputs causing 29-second blocks) effectively serves as proof-of-concept, lowering the exploitation barrier. The patch availability from the vendor and the specificity of affected pattern types (extglobs) make this a clear priority for organizations exposing picomatch to untrusted input, though less urgent for those using only static, trusted patterns. |
| Exploit ScenarioDerived | An attacker identifies a web application that allows users to filter files or search content using glob patterns processed by picomatch, such as a cloud storage interface or code repository search feature. The attacker submits a malicious pattern like '+(a|aa)' with a 41-character non-matching input or a nested pattern like '+(+(a))' with a 33-character input through the API or web form. The Node.js event loop blocks for 2-29 seconds per request, and by sending multiple concurrent requests, the attacker can sustain a complete denial of service, making the application unresponsive to all users until the requests timeout or the service is restarted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
picomatch, a widely-used Node.js glob pattern matching library, contains a Regular Expression Denial of Service (ReDoS) vulnerability when processing crafted extglob patterns such as '+(a|aa)' or nested patterns like '+(+(a))'. The vulnerability affects picomatch versions prior to 4.0.4, 3.0.2, and 2.3.2 (tracked via CPE pkg:npm/picomatch) and allows unauthenticated remote attackers to cause multi-second event-loop blocking with relatively short inputs, resulting in application-wide denial of service. Patches are available from the vendor, and while no KEV listing or EPSS score is provided in the data, the CVSS score of 7.5 (High) reflects the network-accessible, low-complexity attack vector requiring no privileges or user interaction.
RemediationAI
Upgrade picomatch to version 4.0.4, 3.0.2, or 2.3.2 or later depending on your release line, as detailed in the vendor advisory at https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj. The patch commit is available at https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d for verification. If immediate upgrading is not feasible, implement defense-in-depth measures: disable extglob support for untrusted patterns using the 'noextglob: true' option, reject patterns containing nested extglobs or quantifiers like '+()' and '*()', enforce strict allowlists for accepted pattern syntax, isolate pattern matching operations in worker threads or separate processes with timeout limits, and apply rate limiting and input validation on endpoints accepting glob patterns.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
picomatch is a popular npm package used for matching file paths against glob patterns, commonly employed in build tools, testing frameworks, and file processing utilities throughout the Node.js ecosystem. The vulnerability is rooted in CWE-1333 (Inefficient Regular Expression Complexity), where the library's parsing logic in lib/parse.js and lib/constants.js generates regular expressions with catastrophic backtracking behavior when processing extglob quantifiers like '+()' and '*()', particularly when combined with overlapping alternatives or nested structures. For example, the pattern '+(a|aa)' compiles to the regex '^(?:(?=.)(?:a|aa)+)$' which exhibits exponential time complexity on non-matching inputs. This issue parallels CVE-2024-4067 in the related micromatch library and CVE-2024-45296 in path-to-regexp, both involving ReDoS through generated regular expressions.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
picomatch is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as +() and *(), especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input.
Examples of problematic patterns include +(a|aa), +(*|?), +(+(a)), *(+(a)), and +(+(+(a))). In local reproduction, these patterns caused multi-second event-loop blocking with relatively short inputs. For example, +(a|aa) compiled to ^(?:(?=.)(?:a|aa)+)$ and took about 2 seconds to reject a 41-character non-matching input, while nested patterns such as +(+(a)) and *(+(a)) took around 29 seconds to reject a 33-character input on a modern M1 MacBook.
Applications are impacted when they allow untrusted users to supply glob patterns that are passed to picomatch for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.
Patches
This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.
Users should upgrade to one of these versions or later, depending on their supported release line.
Workarounds
If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch.
Possible mitigations include:
- disable extglob support for untrusted patterns by using
noextglob: true - reject or sanitize patterns containing nested extglobs or extglob quantifiers such as
+()and*() - enforce strict allowlists for accepted pattern syntax
- run matching in an isolated worker or separate process with time and resource limits
- apply application-level request throttling and input validation for any endpoint that accepts glob patterns
Resources
- Picomatch repository: https://github.com/micromatch/picomatch
lib/parse.jsandlib/constants.jsare involved in generating the vulnerable regex forms- Comparable ReDoS precedent: CVE-2024-4067 (
micromatch) - Comparable generated-regex precedent: CVE-2024-45296 (
path-to-regexp)
Blast Radius
ecosystem impact- 1 npm packages depend on picomatch (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.0.0.
Executive ViewAI
A critical vulnerability in the picomatch library, commonly used in Node.js applications, allows attackers to crash services through specially crafted input patterns, potentially disrupting business operations and customer access. Organizations using affected versions must prioritize patching to prevent denial-of-service attacks that could impact availability across development, CI/CD, and production environments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in picomatch ReDoS and Injection Vulnerabilities
View all 2Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond
Exploit-DB