picomatch vulnerabilities

CVEs whose affected-version data names the picomatch package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-112366High· 7.5

today

Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), whi…

▾ Twilightmicromatch · picomatchvia CVEORG