High severity7.5NVD Advisory· Published Oct 19, 2026· Updated Oct 19, 2026
CVE-2026-112366
CVE-2026-112366
Description
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=4.0.7
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.