Skip to content

Vendor

micromatch vulnerabilities

4 published CVES affecting micromatch, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
2
Medium
2
Low
0
Unscored
0
CISA KEV
0
Atom feed of micromatch alerts

Products

Latest micromatch CVEs

Newest publication first

  2. CVE-2026-33671 Picomatch has a ReDoS vulnerability via extglob quantifiers

    Published
    HighCVSS 7.5 EPSS 0.43%

    Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as +() and *(), especially when combi...

  3. CVE-2024-4068 Memory Exhaustion in braces

    Published
    HighCVSS 7.5 EPSS 1.5%

    The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to s...

  4. CVE-2024-4067 Regular Expression Denial of Service in micromatch

    Published
    MediumCVSS 5.3 EPSS 1.4%

    The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.