picomatch (npm)

Blazing fast and accurate glob matcher written JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions. Used by GraphQL, Jest, Astro, Snowpack, Storybook, bulma, Serverless, fdir, Netlify, AWS Amplify, Revogrid, rollup, routify, open-wc, imba, ava, docusaurus, fast-glob, globby, chokidar, anymatch, cloudflare/miniflare, pts, and more than 5 million projects! Please follow picomatch's autho

Advisories

Latest version

4.0.7

Released Aug 24, 2026

License

MIT

OpenSSF Scorecard

6.7 / 10

How to fix

Upgrading to 4.0.4 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install picomatch@4.0.7

yarn

yarn add picomatch@4.0.7

pnpm

pnpm add picomatch@4.0.7

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	Medium EPSS 0.43%	`>= 4.0.0, < 4.0.4`	`4.0.4`
GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	Medium EPSS 0.43%	`>= 3.0.0, < 3.0.2`	`3.0.2`
GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	Medium EPSS 0.43%	`< 2.3.2`	`2.3.2`
GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	Medium EPSS 0.43%	`>= 4.0.0, < 4.0.4`	`4.0.4`
GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	Medium EPSS 0.43%	`>= 3.0.0, < 3.0.2`	`3.0.2`
GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	Medium EPSS 0.43%	`< 2.3.2`	`2.3.2`
GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers	High EPSS 0.42%	`>= 4.0.0, < 4.0.4`	`4.0.4`
GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers	High EPSS 0.42%	`>= 3.0.0, < 3.0.2`	`3.0.2`
GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers	High EPSS 0.42%	`< 2.3.2`	`2.3.2`
GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers	High EPSS 0.42%	`>= 4.0.0, < 4.0.4`	`4.0.4`
GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers	High EPSS 0.42%	`>= 3.0.0, < 3.0.2`	`3.0.2`
GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers	High EPSS 0.42%	`< 2.3.2`	`2.3.2`

Source: git+https://github.com/micromatch/picomatch.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor