Skip to content
OpenAdvisories

Package · npm

picomatch

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.3
    CVE-2026-33672

    Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

    Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSI…

    micromatch picomatch node-anymatch node-anymatch Debian Ubuntu npm
  • High 7.5
    CVE-2026-33671 Public exploit

    Picomatch has a ReDoS vulnerability via extglob quantifiers

    Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*(…

    micromatch picomatch node-anymatch node-anymatch Debian Ubuntu npm