{"id":"GHSA-c2c7-rcm5-vvqj","summary":"Picomatch has a ReDoS vulnerability via extglob quantifiers","details":"### Impact\n`picomatch` is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input.\n\nExamples of problematic patterns include `+(a|aa)`, `+(*|?)`, `+(+(a))`, `*(+(a))`, and `+(+(+(a)))`. In local reproduction, these patterns caused multi-second event-loop blocking with relatively short inputs. For example, `+(a|aa)` compiled to `^(?:(?=.)(?:a|aa)+)$` and took about 2 seconds to reject a 41-character non-matching input, while nested patterns such as `+(+(a))` and `*(+(a))` took around 29 seconds to reject a 33-character input on a modern M1 MacBook.\n\nApplications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.\n\n### Patches\nThis issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.\n\nUsers should upgrade to one of these versions or later, depending on their supported release line.\n\n### Workarounds\nIf upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`.\n\nPossible mitigations include:\n- disable extglob support for untrusted patterns by using `noextglob: true`\n- reject or sanitize patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`\n- enforce strict allowlists for accepted pattern syntax\n- run matching in an isolated worker or separate process with time and resource limits\n- apply application-level request throttling and input validation for any endpoint that accepts glob patterns\n\n### Resources\n- Picomatch repository: https://github.com/micromatch/picomatch\n- `lib/parse.js` and `lib/constants.js` are involved in generating the vulnerable regex forms\n- Comparable ReDoS precedent: CVE-2024-4067 (`micromatch`)\n- Comparable generated-regex precedent: CVE-2024-45296 (`path-to-regexp`)","aliases":["CVE-2026-33671"],"modified":"2026-07-17T21:08:19.626874213Z","published":"2026-03-25T21:12:07Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-03-25T21:12:07Z","nvd_published_at":"2026-03-26T22:16:30Z","cwe_ids":["CWE-1333"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33671"},{"type":"WEB","url":"https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d"},{"type":"PACKAGE","url":"https://github.com/micromatch/picomatch"}],"affected":[{"package":{"name":"picomatch","ecosystem":"npm","purl":"pkg:npm/picomatch"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c2c7-rcm5-vvqj/GHSA-c2c7-rcm5-vvqj.json"}},{"package":{"name":"picomatch","ecosystem":"npm","purl":"pkg:npm/picomatch"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c2c7-rcm5-vvqj/GHSA-c2c7-rcm5-vvqj.json"}},{"package":{"name":"picomatch","ecosystem":"npm","purl":"pkg:npm/picomatch"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c2c7-rcm5-vvqj/GHSA-c2c7-rcm5-vvqj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}