Every CVE Search/ Get API key

CVE-2026-112366

Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

8.7 High

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.34%Unchanged since Oct 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
CVE-2026-112366
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
EUVDEUVD-2026-104404 8.7

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
EUVD-2026-104404
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-fc5q-39xc-vjpf 8.7

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows...

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
GHSA-fc5q-39xc-vjpf
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
NVD 8.7

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
CVE-2026-112366
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSV 8.7

Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
CVE-2026-112366
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1333
Updated
2026-11-05
OSVDEBIAN-CVE-2026-112366 8.7

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
DEBIAN-CVE-2026-112366
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2026-112366 8.7

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
UBUNTU-CVE-2026-112366
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-109833 No score

CVE-2026-112366 affecting package nodejs-nodemon 2.0.3-5

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
AZL-109833
Updated
2026-11-05
OSVAZL-110055 No score

CVE-2026-112366 affecting package nodejs 24.22.1-1

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
AZL-110055
Updated
2026-11-05
OSVAZL-110085 No score

CVE-2026-112366 affecting package python-tensorboard 2.16.2-6

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

Record
AZL-110085
Updated
2026-11-02
OSVopenSUSE-SU-2026:12261-1 No score

git-bug-0.11.0-3.1 on GA media

These are all security issues fixed in the git-bug-0.11.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12261-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12421-1 No score

pi-coding-agent-1.5.0-1.1 on GA media

These are all security issues fixed in the pi-coding-agent-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12421-1
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs-nodemon
Azure Linux:3
 through 2.0.3-5 None known
nodejs
Azure Linux:3
 through 24.22.1-1 None known
python-tensorboard
Azure Linux:3
 through 2.16.2-6 None known
node-anymatch
Debian:12
 All versions, plus listed versions
3.1.3+~cs4.6.1-23.1.3+~cs8.0.5-13.1.3+~cs8.0.6-1
 None known
node-anymatch
Debian:13
 All versions, plus listed versions
3.1.3+~cs4.6.1-23.1.3+~cs8.0.5-13.1.3+~cs8.0.6-1
 None known
node-anymatch
Debian:14
 All versions, plus listed versions
3.1.3+~cs4.6.1-23.1.3+~cs8.0.5-13.1.3+~cs8.0.6-1
 None known
node-anymatch
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.3.0-1
 None known
node-anymatch
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.0.3+~2.0.7-33.1.1+~2.1.1-1
 None known
node-anymatch
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.1.1+~2.2.2-13.1.2+~cs4.5.6-1
 None known
node-anymatch
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.1.3+~cs4.6.1-2
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
node-anymatch
Ubuntu:26.10
 All versions, plus listed versions
3.1.3+~cs8.0.6-1
 None known
node-anymatch
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.3+~cs4.6.1-23.1.3+~cs8.0.6-1
 None known
git-bug
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 0.11.0-3.1
0.11.0-3.1
pi-coding-agent
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.5.0-1.1
1.5.0-1.1

History

History
RecordedChangedSources
affected, aliases, facts
affected, aliasesOSV
affected, aliases, referencesOSV
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-112366 is a high vulnerability (CVSS 8.7) in Micromatch Picomatch, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 26th percentile. No source names a fixed version.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open