Executive brief
Picomatch is a widely-used glob pattern matching library used in build tools and file utilities. A Regular Expression Denial of Service (ReDoS) vulnerability allows attackers who can supply untrusted glob patterns to cause excessive CPU consumption and block the Node.js event loop, resulting in application hang or denial of service. Applications using picomatch only with trusted, developer-controlled patterns are not affected.
Technical details
Picomatch compiles glob patterns (including extglob syntax like +(), *()) into regular expressions. Certain patterns with overlapping alternatives or nested extglobs—such as +(a|aa), +(+(a)), and *(+(a))—generate regexes with catastrophic backtracking behavior. When these compiled regexes are matched against non-matching input, they exhibit exponential complexity, causing multi-second event-loop blocking even with short inputs (e.g., 33-41 characters). The vulnerability exists in versions 4.0.0–4.0.3, 3.0.0–3.0.1, and 2.0.0–2.3.1. Attack requires the ability to pass untrusted patterns to picomatch for compilation or matching. Patches are available in versions 4.0.4, 3.0.2, and 2.3.2.
Affected products
- Micromatch Picomatch < 2.3.2, >= 3.0.0 and < 3.0.2, >= 4.0.0 and < 4.0.4
Timeline
- 2026-03-23: disclosed
- 2026-03-23: patched: Patched in versions 4.0.4, 3.0.2, and 2.3.2