picomatch vulnerabilities (npm)

2 vulnerabilities.

• picomatch npm Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching CVE-2026-33672 Fix available 5.3 MediumMarch 25, 2026
• picomatch npm Picomatch has a ReDoS vulnerability via extglob quantifiers CVE-2026-33671 Public exploitFix available 7.5 HighMarch 25, 2026