Description
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| micromatch | picomatch | ≤ 4.0.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-anymatch | No fix yet | — |
| Debian 13 | node-anymatch | No fix yet | — |
| Debian 12 | node-anymatch | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-anymatch | No fix yet | — |
| Ubuntu 26.04 LTS | node-anymatch | No fix yet | — |
| Ubuntu 24.04 LTS | node-anymatch | No fix yet | — |
| Ubuntu 22.04 LTS | node-anymatch | No fix yet | — |
| Ubuntu 20.04 LTS | node-anymatch | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-anymatch | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git-bug | 0.11.0-3.1 | openSUSE-SU-2026:12261-1 |
| openSUSE Tumbleweed | pi-coding-agent | 1.5.0-1.1 | openSUSE-SU-2026:12421-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nodejs +2 | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | node-gyp | No fix yet | — |
Advisories 3
- WID-SEC-2026-4413 IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- openSUSE-SU-2026:12421-1 pi-coding-agent-1.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 5, 2026
- openSUSE-SU-2026:12261-1 git-bug-0.11.0-3.1 on GA media SUSE / openSUSE Security Updates · Oct 25, 2026
References
- https://github.com/micromatch/picomatch/pull/194 patch issue-tracking
- https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307 technical-description
- VulnCheck Advisory: Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns third-party-advisory