Skip to content
OpenAdvisories

Package · Debian

node-anymatch

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-112366

    Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

    Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtg…

    micromatch picomatch node-anymatch node-anymatch Debian Ubuntu
  • Medium 5.3
    CVE-2026-33672

    Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

    Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSI…

    micromatch picomatch node-anymatch node-anymatch Debian Ubuntu npm
  • High 7.5
    CVE-2026-33671 Public exploit

    Picomatch has a ReDoS vulnerability via extglob quantifiers

    Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*(…

    micromatch picomatch node-anymatch node-anymatch Debian Ubuntu npm