CVE-2026-112366 Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
Attackers can cause denial of service in Node.js applications using Picomatch by supplying crafted extglob patterns that trigger exponential backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-112366?
CVE-2026-112366 is a high-severity denial of service vulnerability in micromatch picomatch, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
Weakness: CWE-1333
Which versions are affected by CVE-2026-112366?
How do I fix CVE-2026-112366?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-112366 being exploited?
There is no known exploitation of CVE-2026-112366 in the wild and no public exploit code.
Sources
Also known as AZL-109833, AZL-110055, AZL-110085, DEBIAN-CVE-2026-112366, GHSA-fc5q-39xc-vjpf, UBUNTU-CVE-2026-112366.