{"id":"CVE-2026-112366","title":"Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns","summary":"Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), whi…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-1333"],"vendor":"micromatch","product":"picomatch","affected":["picomatch <= 4.0.7"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T16:40:06.341512Z"},"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T16:40:19.321Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112366","references":[{"url":"https://github.com/micromatch/picomatch/pull/194"},{"url":"https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307"},{"url":"https://www.vulncheck.com/advisories/picomatch-through-4.0.7-redos-via-single-branch-repeated-extglob-patterns","label":"VulnCheck Advisory: Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T16:32:30.079Z","slug":"CVE-2026-112366","body":"## Overview\n\nPicomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.\n\n## Affected\n\n- `picomatch <= 4.0.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}