GHSA-c2c7-rcm5-vvqj CVE-2026-33671
Picomatch has a ReDoS vulnerability via extglob quantifiers
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.42%
- Chance of exploitation in the next 30 days. Higher than 36.32% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
4.0.4- Upgrade picomatch to this version or later
Description
Impact
picomatch is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as +() and *(), especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input.
Examples of problematic patterns include +(a|aa), +(*|?), +(+(a)), *(+(a)), and +(+(+(a))). In local reproduction, these patterns caused multi-second event-loop blocking with relatively short inputs. For example, +(a|aa) compiled to ^(?:(?=.)(?:a|aa)+)$ and took about 2 seconds to reject a 41-character non-matching input, while nested patterns such as +(+(a)) and *(+(a)) took around 29 seconds to reject a 33-character input on a modern M1 MacBook.
Applications are impacted when they allow untrusted users to supply glob patterns that are passed to picomatch for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.
Patches
This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.
Users should upgrade to one of these versions or later, depending on their supported release line.
Workarounds
If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch.
Possible mitigations include:
- disable extglob support for untrusted patterns by using
noextglob: true - reject or sanitize patterns containing nested extglobs or extglob quantifiers such as
+()and*() - enforce strict allowlists for accepted pattern syntax
- run matching in an isolated worker or separate process with time and resource limits
- apply application-level request throttling and input validation for any endpoint that accepts glob patterns
Resources
- Picomatch repository: https://github.com/micromatch/picomatch
lib/parse.jsandlib/constants.jsare involved in generating the vulnerable regex forms- Comparable ReDoS precedent: CVE-2024-4067 (
micromatch) - Comparable generated-regex precedent: CVE-2024-45296 (
path-to-regexp)
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| picomatch | >= 4.0.0, < 4.0.4 |
4.0.4 |
| picomatch | >= 3.0.0, < 3.0.2 |
3.0.2 |
| picomatch | < 2.3.2 |
2.3.2 |
| picomatch | >= 4.0.0, < 4.0.4 |
4.0.4 |
| picomatch | >= 3.0.0, < 3.0.2 |
3.0.2 |
| picomatch | < 2.3.2 |
2.3.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
picomatch npm → 4.0.4
- npm
npm install picomatch@4.0.4- yarn
yarn add picomatch@4.0.4- pnpm
pnpm add picomatch@4.0.4
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Fixes and patches
Packages
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching | Medium | Also affects picomatch |
| GHSA-7wch-p9px-956x Forge: Regular expression denial of service in PEM decoding (pem.decode) | High | Same weakness, CWE-1333 |
| GHSA-xcq7-p3pf-p88h OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api | Medium | Same weakness, CWE-1333 |
| GHSA-xgh8-jp6q-p5x8 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes | High | Same weakness, CWE-1333 |
| GHSA-rxp7-6hxx-x8q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process | Medium | Same weakness, CWE-1333 |
| GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header | High | Same weakness, CWE-1333 |
| GHSA-4ffr-jq9g-5ffx Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service | High | Same weakness, CWE-1333 |
| GHSA-m64x-33q8-m5h7 GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines | High | Same weakness, CWE-1333 |
Credits: ByamB4, danez, doowb
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor