Vulnpedia
← Search CVEs

CVE-2026-112366

HIGH 8.7

Published 2026-10-19 · Last modified 2026-10-19

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

ELEVATED IMPACT

Severe if exploited (CVSS 8.7), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 27th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.7CVSS 4.0 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Micromatch

Products Picomatch

Weakness (CWE)

  • CWE-1333: Inefficient Regular Expression Complexity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

  • grafana12.4.src as a component of Red Hat Hardened Images · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce execution timeouts and step limits on pattern-matching operations, or reject untrusted single-branch repeated extglob expressions before evaluating them with picomatch: upgrade to the fixed Llvm/Swift Lang/Grafana/Prometheus/Ruff/Dotnet/Rust/Yarnpkg builds, which mark mixed wildcards as risky across all branch counts within analyzeRepeatedExtglob, closing all 2 injection vectors (crafted single-branch repeated extglob patterns, crafted input strings triggering catastrophic backtracking). Until patched, this is a concern on Applications evaluating attacker-controlled glob patterns or matching untrusted inputs against repeated extglobs, so Validate and reject untrusted glob patterns containing single-branch repeated extglobs such as +(*) or +(*a) before passing them to picomatch, and avoid evaluating untrusted input strings against repeated extglob patterns. These controls limit blast radius and contain exploitation, but they do not fix the underlying regular expression catastrophic backtracking defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)
    • none available: Affected
    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • grafana13.1.src as a component of Red Hat Hardened Images · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce execution timeouts and step limits on pattern-matching operations, or reject untrusted single-branch repeated extglob expressions before evaluating them with picomatch: upgrade to the fixed Llvm/Swift Lang/Grafana/Prometheus/Ruff/Dotnet/Rust/Yarnpkg builds, which mark mixed wildcards as risky across all branch counts within analyzeRepeatedExtglob, closing all 2 injection vectors (crafted single-branch repeated extglob patterns, crafted input strings triggering catastrophic backtracking). Until patched, this is a concern on Applications evaluating attacker-controlled glob patterns or matching untrusted inputs against repeated extglobs, so Validate and reject untrusted glob patterns containing single-branch repeated extglobs such as +(*) or +(*a) before passing them to picomatch, and avoid evaluating untrusted input strings against repeated extglob patterns. These controls limit blast radius and contain exploitation, but they do not fix the underlying regular expression catastrophic backtracking defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)
    • none available: Affected
    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • grafana13.2.src as a component of Red Hat Hardened Images · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce execution timeouts and step limits on pattern-matching operations, or reject untrusted single-branch repeated extglob expressions before evaluating them with picomatch: upgrade to the fixed Llvm/Swift Lang/Grafana/Prometheus/Ruff/Dotnet/Rust/Yarnpkg builds, which mark mixed wildcards as risky across all branch counts within analyzeRepeatedExtglob, closing all 2 injection vectors (crafted single-branch repeated extglob patterns, crafted input strings triggering catastrophic backtracking). Until patched, this is a concern on Applications evaluating attacker-controlled glob patterns or matching untrusted inputs against repeated extglobs, so Validate and reject untrusted glob patterns containing single-branch repeated extglobs such as +(*) or +(*a) before passing them to picomatch, and avoid evaluating untrusted input strings against repeated extglob patterns. These controls limit blast radius and contain exploitation, but they do not fix the underlying regular expression catastrophic backtracking defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)
    • none available: Affected
    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • prometheus3.13.src as a component of Red Hat Hardened Images · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce execution timeouts and step limits on pattern-matching operations, or reject untrusted single-branch repeated extglob expressions before evaluating them with picomatch: upgrade to the fixed Llvm/Swift Lang/Grafana/Prometheus/Ruff/Dotnet/Rust/Yarnpkg builds, which mark mixed wildcards as risky across all branch counts within analyzeRepeatedExtglob, closing all 2 injection vectors (crafted single-branch repeated extglob patterns, crafted input strings triggering catastrophic backtracking). Until patched, this is a concern on Applications evaluating attacker-controlled glob patterns or matching untrusted inputs against repeated extglobs, so Validate and reject untrusted glob patterns containing single-branch repeated extglobs such as +(*) or +(*a) before passing them to picomatch, and avoid evaluating untrusted input strings against repeated extglob patterns. These controls limit blast radius and contain exploitation, but they do not fix the underlying regular expression catastrophic backtracking defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)
    • none available: Affected
    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • prometheus3.5.src as a component of Red Hat Hardened Images · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce execution timeouts and step limits on pattern-matching operations, or reject untrusted single-branch repeated extglob expressions before evaluating them with picomatch: upgrade to the fixed Llvm/Swift Lang/Grafana/Prometheus/Ruff/Dotnet/Rust/Yarnpkg builds, which mark mixed wildcards as risky across all branch counts within analyzeRepeatedExtglob, closing all 2 injection vectors (crafted single-branch repeated extglob patterns, crafted input strings triggering catastrophic backtracking). Until patched, this is a concern on Applications evaluating attacker-controlled glob patterns or matching untrusted inputs against repeated extglobs, so Validate and reject untrusted glob patterns containing single-branch repeated extglobs such as +(*) or +(*a) before passing them to picomatch, and avoid evaluating untrusted input strings against repeated extglob patterns. These controls limit blast radius and contain exploitation, but they do not fix the underlying regular expression catastrophic backtracking defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)
    • no fix planned: Will not fix
    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • dotnet8.0.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • llvm21.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • ruff.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • rust.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • swift-lang.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00
  • yarnpkg.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-112366 · Updated 2026-10-20T20:58:56+00:00

All CVSS metrics

  • HIGH 8.7 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 8.7 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS