node-anymatch vulnerabilities (Debian)

3 vulnerabilities.

• node-anymatch Debian Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns CVE-2026-112366 Fix available 8.7 HighOctober 19, 2026
• node-anymatch Debian Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching CVE-2026-33672 Fix available 5.3 MediumMarch 25, 2026
• node-anymatch Debian Picomatch has a ReDoS vulnerability via extglob quantifiers CVE-2026-33671 Public exploitFix available 7.5 HighMarch 25, 2026