CVE-2026-112366highCWE-1333

CVE-2026-112366: falha de alta gravidade em micromatch picomatch

Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

Publicada em

Seguir esta CVE+ Monitorar picomatch+ Monitorar node-anymatch

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.3%
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
micromatch · picomatch
CVEs relacionadas — micromatch picomatch

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33672MEDIUMPicomatch: Method Injection in POSIX Character Classes causes incorrect Glob MatchingEPSS 0.4%CVE-2026-33671HIGHPicomatch has a ReDoS vulnerability via extglob quantifiersEPSS 0.4%