Picomatch
Monthly
Denial of service in picomatch through 4.0.7: a malicious glob pattern such as +(*) or +(*a) compiles into a catastrophically backtracking regular expression that blocks the Node.js event loop and hangs the host application. The flaw sits in analyzeRepeatedExtglob in lib/parse.js, which skipped single-branch repeated extglobs and therefore missed the nested unbounded quantifiers that cause exponential blowup, so risk concentrates in applications that feed attacker-controlled glob patterns into picomatch or its consumers (micromatch, globby, chokidar) with extglob support left at its default. No public exploit code and no CISA KEV entry were identified at time of analysis, and an upstream fix is available as PR #194; fixed-pattern-only usage is not exploitable even though the assessed vector is PR:N/UI:N.
Denial of service in picomatch through 4.0.7: a malicious glob pattern such as +(*) or +(*a) compiles into a catastrophically backtracking regular expression that blocks the Node.js event loop and hangs the host application. The flaw sits in analyzeRepeatedExtglob in lib/parse.js, which skipped single-branch repeated extglobs and therefore missed the nested unbounded quantifiers that cause exponential blowup, so risk concentrates in applications that feed attacker-controlled glob patterns into picomatch or its consumers (micromatch, globby, chokidar) with extglob support left at its default. No public exploit code and no CISA KEV entry were identified at time of analysis, and an upstream fix is available as PR #194; fixed-pattern-only usage is not exploitable even though the assessed vector is PR:N/UI:N.