CVE-2026-112366: Picomatch ReDoS Vulnerability Freezes Node.js Apps via Glob Patterns

A high-severity regular expression denial of service vulnerability has been identified in picomatch, a widely used file matching library. The flaw, tracked as CVE-2026-112366, impacts versions through 4.0.7 and allows attackers to disrupt Node.js applications by blocking the event loop.

What happened

The vulnerability, rated CVSS 8.7 HIGH, exists in picomatch through version 4.0.7. According to the National Vulnerability Database record, the issue stems from how the library handles specific regular expression patterns. Attackers can supply single-branch repeated extglob patterns, such as +() or +(a), to trigger the flaw.

The root cause lies in the analyzeRepeatedExtglob function within lib/parse.js. This component skips these specific patterns during processing. The skip leads to exponential backtracking when the library encounters short crafted strings. This computational overhead effectively denies service to Node.js applications using the affected library.

The National Vulnerability Database categorizes the weakness under CWE-1333. The record lists both micromatch and picomatch as affected packages. The impact is strictly on the event loop of the host application. No remote code execution or data theft is described in the source material.

Why it matters

Node.js applications rely on a single-threaded event loop for handling asynchronous operations. Blocking this loop halts all other processing in the application. This makes the system unresponsive to legitimate requests and inputs.

Organizations using picomatch for file filtering, globbing, or pattern matching are exposed. The vulnerability does not require complex payload construction. Simple patterns like +(*) are sufficient to trigger the exponential backtracking behavior. This lowers the barrier for attackers to launch denial-of-service attacks.

The flaw affects a foundational component in many JavaScript ecosystems. Applications that process user-supplied input directly into picomatch functions are at risk. Even indirect usage through micromatch exposes environments to the same event loop blocking behavior.

Our take on the response

The source material does not confirm the availability of a patch or update. Security teams should assume no fix has been confirmed yet. Immediate mitigation may involve restricting input to trusted sources or validating patterns before processing.

Teams should review their dependency trees for picomatch versions up to 4.0.7. If updating is not immediately possible, input validation controls should be strengthened. Monitoring for sudden spikes in CPU usage or event loop lag can help detect active exploitation attempts.

What defenders should look for

Teams usually detect regular expression denial of service attacks through monitoring application performance metrics rather than network traffic. Check whether Node.js processes exhibit sudden spikes in CPU utilization without corresponding increases in request volume. Look for event loop lag indicators in application logs, where asynchronous callbacks take significantly longer to execute. Investigate patterns that appear benign but cause immediate process freezing. First containment moves involve isolating affected services to prevent cascading failures across the application stack. Review input logs for unusual glob patterns that match known trigger sequences.

Background: Input validation

Input validation is the process of verifying that data entering a system matches expected formats, types, and ranges before processing. It prevents malicious payloads from executing code or crashing services. You must validate at every entry point, not just the user interface, because attackers bypass front-end checks entirely.

Read the full guide: What Is Input Validation: How to Stop Bad Data From Breaking Systems

What to do and how to stay safe: picomatch

• Inventory all Node.js projects to identify dependencies on picomatch or micromatch versions up to 4.0.7.
• Implement strict input validation to reject or sanitize single-branch repeated extglob patterns before they reach the library.
• Monitor application health metrics for unexpected event loop delays or CPU exhaustion during pattern matching operations.
• Watch vendor announcements for confirmed patches and plan updates once the vendor provides an update.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of picomatch are affected by CVE-2026-112366?

All versions of picomatch through 4.0.7 are affected by this vulnerability.

What is the primary impact of this vulnerability?

The vulnerability allows attackers to block the Node.js event loop, causing denial of service.

Is there a confirmed patch for this issue?

No fix has been confirmed yet according to the available source material.