CVE-2026-33671

A flaw was found in Picomatch, a JavaScript glob matcher. This Regular Expression Denial of Service (ReDoS) vulnerability allows a remote attacker to cause excessive CPU consumption and block the Node.js event loop, leading to a denial of service. This occurs when untrusted users supply crafted extglob patterns, specifically those using quantifiers like +() and *() combined with overlapping alternatives or nested extglobs, which can trigger catastrophic backtracking in the compiled regular expressions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, applications using Picomatch should avoid passing untrusted glob patterns for compilation or matching. Implementations can disable extglob support for untrusted patterns by setting noextglob: true in Picomatch configurations. Alternatively, reject or sanitize patterns containing nested extglobs or specific extglob quantifiers like +() and *(). Enforcing strict allowlists for accepted pattern syntax can also reduce exposure. If the application is a service, consider running the matching process in an isolated worker or separate process with time and resource limits, and apply application-level request throttling and input validation for any endpoint that accepts glob patterns. No service restart or reload is typically required for these application-level configuration changes, but verify the specific application's behavior.