micromatch picomatch vulnerabilities

Latest micromatch picomatch CVEs

Newest publication first

1. CVE-2026-33672 Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

   Published 2026-03-26

   Medium·CVSS 5.3 EPSS 0.43%

   Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the POSIX_REGEX_SOURCE object. Because the object inherits from Object.prototype, specially crafted POSIX bracket expressions (e....

2. CVE-2026-33671 Picomatch has a ReDoS vulnerability via extglob quantifiers

   Published 2026-03-26

   High·CVSS 7.5 EPSS 0.43%

   Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as +() and *(), especially when combi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.