CVE-2026-112366
Received Received - Intake

Regular Expression Denial of Service in Picomatch

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112366
EUVD
EUVD-2026-104404

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
micromatch picomatch 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Picomatch through 4.0.7 has a regular expression denial of service (ReDoS) vulnerability. Attackers can exploit this by providing specially crafted glob patterns like +(*) or +(*a) that cause exponential backtracking in the analyzeRepeatedExtglob function in lib/parse.js. This blocks the Node.js event loop, denying service to applications.

Detection Guidance

This vulnerability can be detected by checking if Picomatch version 4.0.7 or earlier is installed. Use commands like 'npm list picomatch' or 'npm list micromatch' to verify the version. If vulnerable versions are found, update to the latest version immediately.

Impact Analysis

If you use Picomatch in a Node.js application, an attacker could send malicious input to crash or slow down your application by consuming excessive CPU resources. This could lead to downtime, poor performance, or complete denial of service for users.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or data unavailability, which may violate availability requirements in GDPR (Article 32) or HIPAA (Security Rule). Downtime could also lead to breaches if sensitive data processing is interrupted.

Mitigation Strategies

Immediately update Picomatch to a version later than 4.0.7 using 'npm update picomatch' or by modifying your package.json to specify a newer version. If updating is not possible, consider removing or replacing the affected component in your application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart