npm/picomatch CVE-2026-33671: high 7.5, EPSS 0.51%
Picomatch has a ReDoS vulnerability via extglob quantifiers
Action: Upgrade picomatch to 2.3.2 or later.
npm i picomatch@4.0.4npm i picomatch@3.0.2npm i picomatch@2.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.0.4 | - |
| 3.0.0 | 3.0.2 | - |
| 0 | 2.3.2 | - |
Fixed versions
| 4.0.4 | 3.0.2 | 2.3.2 |
Sources
- osv: GHSA-c2c7-rcm5-vvqj
- https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj
- https://nvd.nist.gov/vuln/detail/CVE-2026-33671
- https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d
- https://github.com/micromatch/picomatch
CVE-2026-33671 · published · modified · JSON