PT-2026-28172 · Picomatch · Picomatch

Byamb4 · Published 2026-03-25 · Updated 2026-04-08 · CVE-2026-33671

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Picomatch versions prior to 4.0.4 Picomatch versions prior to 3.0.2 Picomatch versions prior to 2.3.2

Description Picomatch, a glob matcher written in JavaScript, is susceptible to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Specific patterns utilizing extglob quantifiers like +() and *(), particularly when combined with overlapping alternatives or nested extglobs, can be compiled into regular expressions that exhibit catastrophic backtracking on non-matching input. Applications allowing untrusted users to supply glob patterns to picomatch for compilation or matching are at risk. An attacker can potentially cause excessive CPU consumption and disrupt the Node.js event loop, leading to a denial of service. Applications using only trusted, developer-controlled glob patterns are less likely to be affected.

Recommendations Versions prior to 4.0.4: Upgrade to version 4.0.4 or later. Versions prior to 3.0.2: Upgrade to version 3.0.2 or later. Versions prior to 2.3.2: Upgrade to version 2.3.2 or later. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Disable extglob support for untrusted patterns by using noextglob: true. Reject or sanitize patterns containing nested extglobs or extglob quantifiers such as +() and *(). Enforce strict allowlists for accepted pattern syntax. Run matching in an isolated worker or separate process with time and resource limits. Apply application-level request throttling and input validation for any endpoint that accepts glob patterns.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-33671

GHSA-C2C7-RCM5-VVQJ

Affected Products

Picomatch

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33671.json · Exploit
• https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d · Patch
• https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33671 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33671 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33671 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-33671 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33671 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33671 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33671 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33671 · Vendor Advisory
• https://github.com/micromatch/picomatch · Note
• https://twitter.com/CVEnew/status/2037280509970309131 · Twitter Post
• https://twitter.com/LambdaWatchdog/status/2038949656814555636 · Twitter Post