Maximilliangrand

**Name of the Vulnerable Software and Affected Versions** Picomatch versions prior to 4.0.8 **Description** A regular expression denial of service (ReDoS) occurs when parsing single-branch repeated extglob patterns, such as +(*) or +(*a). The `analyzeRepeatedExtglob()` function in lib/parse.js fails to handle these patterns correctly, leading to exponential backtracking when processing short crafted strings. This behavior blocks the Node.js event loop, resulting in an application-level denial of service for services that compile or use attacker-controlled globs. **Recommendations** Update to version 4.0.8 or later.