EUVD-2026-104404
GHSA-fc5q-39xc-vjpf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted repeated extglob pattern (+(*a))
-
ExploitanalyzeRepeatedExtglob skips risky branch
-
ExecutionCompiled regex backtracks exponentially on short string
-
ImpactNode.js event loop blocked, service denied
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Node.js application pass ATTACKER-CONTROLLED glob patterns into picomatch's parser/compiler (picomatch, or anything built on it such as micromatch/globby/chokidar), specifically allowing a single-branch repeated extglob of the form +(*) or +(*a). The limiting factor is significant: the ReDoS is triggered by the PATTERN, not the matched string, so applications that only use fixed developer-defined patterns are not exploitable even though the CVSS shows PR:N/UI:N. No authentication or user interaction is needed once pattern input is reachable, and default picomatch behavior (extglob enabled) is sufficient - setting noextglob:true disables the vulnerable code path. |
| Impact | This is a CWE-1333 regular expression denial of service (ReDoS) in picomatch ≤4.0.7. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 (High) and reflects availability-only impact (VA:H, VC:N/VI:N) - there is no confidentiality or integrity exposure, so the raw score is driven entirely by event-loop blocking. No EPSS score, no CISA KEV listing, no SSVC decision record, and no POC flag were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only exploitation signal is the vendor/VulnCheck advisory and the source-level PR fix. The most important caveat the CVSS does not capture is the trigger surface: the vulnerability fires from the GLOB PATTERN (e.g. +(*), +(*a)), not from the matched string, so real-world risk depends on whether an application lets untrusted input reach picomatch pattern COMPILATION - uncommon in typical usage where patterns are developer-defined. Therefore the PR:N/network rating is technically correct for the library but overstates practical exposure for most deployments: this is a legitimate availability bug to patch, but it is a moderate real-world priority outside applications that accept user-supplied globs, not a drop-everything issue. |
| Exploit ScenarioDerived | A Node.js service exposes functionality that passes user-controlled glob patterns to picomatch (e.g. a file-search or filter API). An attacker submits a single-branch repeated extglob such as +(*a) together with a short non-matching string; analyzeRepeatedExtglob fails to flag it, the compiled regex backtracks exponentially, and the single-threaded event loop stalls, denying service to all concurrent users. No weaponized public POC is listed, though the advisory and description name the exact triggering patterns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Denial of service in picomatch through 4.0.7: a malicious glob pattern such as +(*) or +(*a) compiles into a catastrophically backtracking regular expression that blocks the Node.js event loop and hangs the host application. The flaw sits in analyzeRepeatedExtglob in lib/parse.js, which skipped single-branch repeated extglobs and therefore missed the nested unbounded quantifiers that cause exponential blowup, so risk concentrates in applications that feed attacker-controlled glob patterns into picomatch or its consumers (micromatch, globby, chokidar) with extglob support left at its default. No public exploit code and no CISA KEV entry were identified at time of analysis, and an upstream fix is available as PR #194; fixed-pattern-only usage is not exploitable even though the assessed vector is PR:N/UI:N.
RemediationAI
Patch status: upstream fix available (PR/commit); released patched version not independently confirmed from the supplied data, so confirm by upgrading picomatch past 4.0.7 to the first npm release containing https://github.com/micromatch/picomatch/pull/194, then pin it in the lockfile, re-run npm audit, and update transitive consumers (micromatch, globby, chokidar, fast-glob) that vendor the same code, cross-checking the VulnCheck advisory at https://www.vulncheck.com/advisories/picomatch-through-4.0.7-redos-via-single-branch-repeated-extglob-patterns. If the upgrade cannot land immediately, set noextglob: true in picomatch options to close the vulnerable code path entirely, accepting that legitimate extglob syntax such as +(...), @(...) and !(...) will stop matching; alternatively enforce a centralized pattern policy that rejects unescaped extglob openers and bodies mixing * and ? before any call into picomatch or micromatch, accepting false positives on valid globs; and run pattern compilation plus matching in a worker thread or child process with a hard timeout so a blown-up match cannot pin the main event loop, accepting added latency, deployment complexity, and the need to kill and restart the worker since V8 regex backtracking is not interruptible. Length caps on patterns and subjects are only defense-in-depth here because the blowup triggers on very short strings, so never route raw request parameters into picomatch as a substitute for the fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
picomatch is the glob-to-RegExp compiler used by micromatch, globby, chokidar and much of the Node.js file-matching ecosystem, so a pathological pattern affects every layer stacked on top of it. In extglob syntax a leading +( ... ) means one-or-more repetitions; when the body itself contains an unbounded wildcard such as * or *a, the emitted RegExp nests an unbounded quantifier inside a repeat (roughly (?:[^/][^/]*?a)+), which backtracks exponentially against short crafted subjects and pins the single-threaded event loop. The pre-fix analyzeRepeatedExtglob at lib/parse.js lines 287-307 returned early for single-branch extglobs, so the +(*) family was never classified as risky; PR #194 adds a top-level hasMixedWildcards() scanner that flags branches mixing * and ? while correctly skipping escaped characters, bracket expressions and nested parens, and rewrites extglob tokenization with isExtglobOpen()/afterExtglobOpenParen() so a leading ? inside an extglob body is treated as a wildcard rather than as a regex-group prefix like (?:. This is CWE-1333 (Inefficient Regular Expression Complexity); because the malicious artifact is the pattern itself rather than the subject string, exposure is gated entirely on whether untrusted glob input reaches the parser.
Know when Picomatch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Availability-only ReDoS reachable remotely with low complexity when untrusted patterns reach picomatch; PR:N/UI:N as the library itself needs no auth, C:N/I:N since only event-loop stalls.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
Executive ViewAI
CVE-2026-112366 is a high-severity availability flaw in picomatch through 4.0.7 that can let a crafted glob pattern stall Node.js applications by monopolizing the event loop. Exposure is concentrated in services that accept attacker-controlled glob patterns or rely on picomatch-dependent tooling such as micromatch, globby, and chokidar; no public exploit identified at time of analysis. Leadership should treat this as an operational resilience issue for affected applications, prioritize dependency inventory and patching, and restrict untrusted pattern input until fixes are deployed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB