Skip to content
OpenAdvisories

Package · Debian

node-anymatch

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-33671 Public exploit

    Picomatch has a ReDoS vulnerability via extglob quantifiers

    Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*(…

    micromatch picomatch node-anymatch node-anymatch Debian Ubuntu npm