CVE-2026-112366

Name of the Vulnerable Software and Affected Versions Picomatch versions prior to 4.0.8

Description A regular expression denial of service (ReDoS) occurs when parsing single-branch repeated extglob patterns, such as +(*) or +(*a). The analyzeRepeatedExtglob() function in lib/parse.js fails to handle these patterns correctly, leading to exponential backtracking when processing short crafted strings. This behavior blocks the Node.js event loop, resulting in an application-level denial of service for services that compile or use attacker-controlled globs.

Recommendations Update to version 4.0.8 or later.