CVE-2026-112366

7.5High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-1333

Impact

Remote unauthenticated attackers can trigger a denial of service by stalling the Node.js event loop. They only need to supply crafted glob patterns like +(*) to an application endpoint that uses picomatch.

Root cause

The analyzeRepeatedExtglob function skips single-branch repeated extglob patterns, creating regular expressions prone to exponential backtracking.

Affected systems

picomatch through 4.0.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade picomatch to a version containing PR #194 once released. As an interim workaround, sanitize or reject user-supplied glob strings containing repeated extglob syntax like +(*).

shell

$ npm ls picomatch

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112366