What is the CVSS score of CVE-2026-33671?

CVE-2026-33671 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-33671?

A critical vulnerability in the picomatch library, commonly used in Node.js applications, allows attackers to crash services through specially crafted input patterns, potentially disrupting business…. A patch is available.

How to fix or mitigate CVE-2026-33671?

Within 24 hours: Inventory all applications and dependencies using picomatch across development, testing, and production environments. Within 7 days: Apply vendor patches (versions 4.0.4, 3.0.2, or 2.3.2+) to all affected systems and conduct regression testing. Within 30 days: Implement dependency scanning tools to prevent similar vulnerabilities and establish a process for rapid patching of high-severity supply-chain issues.

Node.js CVE-2026-33671

HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-03-25 https://github.com/micromatch/picomatch

Denial Of Service Node.js Red Hat

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

6.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 25, 2026 - 21:17 vuln.today

Patch released

Mar 25, 2026 - 21:17 nvd

Patch available

CVE Published

Mar 25, 2026 - 21:12 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on picomatch (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionGitHub Advisory

Impact

picomatch is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as +() and *(), especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input.

Examples of problematic patterns include +(a|aa), +(*|?), +(+(a)), *(+(a)), and +(+(+(a))). In local reproduction, these patterns caused multi-second event-loop blocking with relatively short inputs. For example, +(a|aa) compiled to ^(?:(?=.)(?:a|aa)+)$ and took about 2 seconds to reject a 41-character non-matching input, while nested patterns such as +(+(a)) and *(+(a)) took around 29 seconds to reject a 33-character input on a modern M1 MacBook.

Applications are impacted when they allow untrusted users to supply glob patterns that are passed to picomatch for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.

Patches

This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.

Users should upgrade to one of these versions or later, depending on their supported release line.

Workarounds

If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch.

Possible mitigations include:

disable extglob support for untrusted patterns by using noextglob: true
reject or sanitize patterns containing nested extglobs or extglob quantifiers such as +() and *()
enforce strict allowlists for accepted pattern syntax
run matching in an isolated worker or separate process with time and resource limits
apply application-level request throttling and input validation for any endpoint that accepts glob patterns

Resources

Picomatch repository: https://github.com/micromatch/picomatch
lib/parse.js and lib/constants.js are involved in generating the vulnerable regex forms
Comparable ReDoS precedent: CVE-2024-4067 (micromatch)
Comparable generated-regex precedent: CVE-2024-45296 (path-to-regexp)

AnalysisAI

picomatch, a widely-used Node.js glob pattern matching library, contains a Regular Expression Denial of Service (ReDoS) vulnerability when processing crafted extglob patterns such as '+(a|aa)' or nested patterns like '+(+(a))'. The vulnerability affects picomatch versions prior to 4.0.4, 3.0.2, and 2.3.2 (tracked via CPE pkg:npm/picomatch) and allows unauthenticated remote attackers to cause multi-second event-loop blocking with relatively short inputs, resulting in application-wide denial of service. Patches are available from the vendor, and while no KEV listing or EPSS score is provided in the data, the CVSS score of 7.5 (High) reflects the network-accessible, low-complexity attack vector requiring no privileges or user interaction.

Technical ContextAI

picomatch is a popular npm package used for matching file paths against glob patterns, commonly employed in build tools, testing frameworks, and file processing utilities throughout the Node.js ecosystem. The vulnerability is rooted in CWE-1333 (Inefficient Regular Expression Complexity), where the library's parsing logic in lib/parse.js and lib/constants.js generates regular expressions with catastrophic backtracking behavior when processing extglob quantifiers like '+()' and '*()', particularly when combined with overlapping alternatives or nested structures. For example, the pattern '+(a|aa)' compiles to the regex '^(?:(?=.)(?:a|aa)+)$' which exhibits exponential time complexity on non-matching inputs. This issue parallels CVE-2024-4067 in the related micromatch library and CVE-2024-45296 in path-to-regexp, both involving ReDoS through generated regular expressions.

RemediationAI

Upgrade picomatch to version 4.0.4, 3.0.2, or 2.3.2 or later depending on your release line, as detailed in the vendor advisory at https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj. The patch commit is available at https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d for verification. If immediate upgrading is not feasible, implement defense-in-depth measures: disable extglob support for untrusted patterns using the 'noextglob: true' option, reject patterns containing nested extglobs or quantifiers like '+()' and '*()', enforce strict allowlists for accepted pattern syntax, isolate pattern matching operations in worker threads or separate processes with timeout limits, and apply rate limiting and input validation on endpoints accepting glob patterns.