CVE-2024-4067 Regular Expression Denial of Service in micromatch
An attacker can cause a denial of service in applications using micromatch by submitting malicious input that triggers excessive regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-4067?
CVE-2024-4067 is a medium-severity denial of service vulnerability in micromatch, published on 13 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
Weakness: CWE-1333
Which versions are affected by CVE-2024-4067?
2 open source packages ship an affected version, including micromatch. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
micromatch npm | All versions | 4.0.8 |
micromatch npm | All versions | 4.0.8 |
Products include Jonschlinkert Micromatch.
How do I fix CVE-2024-4067?
Upgrade micromatch to 4.0.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-4067 being exploited?
There is no known exploitation of CVE-2024-4067 in the wild and no public exploit code.
Sources
Also known as AZL-43999, AZL-44454, CLEANSTART-2026-PI37875, CLSA-2026-1774830268, CLSA-2026-1776731781, DEBIAN-CVE-2024-4067 and 6 more.