{"action":"Upgrade micromatch to 4.0.8 or later.","affected":[{"fixed":"4.0.8","introduced":"0"}],"component":"micromatch","cve_ids":["CVE-2024-4067"],"ecosystem":"npm","epss":0.01429,"exploited":false,"fixed_versions":["4.0.8"],"ghsa_id":"GHSA-952p-6rrq-rcjv","id":"tcs_01M5KFES91DMW1EQKV1H09RGJ5","modified_at":"2026-09-10T03:50:13.524150483Z","published_at":"2024-05-14T18:30:54Z","references":["https://osv.dev/vulnerability/GHSA-952p-6rrq-rcjv","https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-952p-6rrq-rcjv","url":"https://osv.dev/vulnerability/GHSA-952p-6rrq-rcjv"}],"summary":"Regular Expression Denial of Service (ReDoS) in micromatch"}