Skip to content
OpenAdvisories

Package · Debian

node-anymatch

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-112366

    Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

    Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtg…

    micromatch picomatch node-anymatch node-anymatch Debian Ubuntu
  • High 7.5
    CVE-2026-33671 Public exploit

    Picomatch has a ReDoS vulnerability via extglob quantifiers

    Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*(…

    micromatch picomatch node-anymatch node-anymatch Debian Ubuntu npm