Key points
- Picomatch versions up to 4.0.7 are affected by CVE-2026-112366
- The flaw allows attackers to block the event loop via crafted globs
- No patch or fix has been confirmed by the vendor yet
The Picomatch library, used in Node.js applications, contains a high-severity vulnerability through version 4.0.7. According to the National Vulnerability Database, this flaw is tracked as CVE-2026-112366. The issue allows attackers to disrupt application performance by supplying specific input patterns. Small-business owners relying on Node.js services should verify their dependency versions immediately. The National Vulnerability Database rates the severity at 8.7, which is considered high. This exposure affects any software that includes the vulnerable library in its codebase.
In plain English
This security issue is a regular expression denial of service vulnerability. Attackers can freeze an application’s event loop by sending specially crafted text strings. These strings use single-branch repeated extglob patterns, such as plus signs with parentheses. The library fails to handle these patterns correctly during parsing. This causes the application to perform excessive calculations, leading to a complete service denial. Users experience unresponsive applications or total downtime while the event loop is blocked.
The background
The vulnerability exists in the lib/parse.js file of the Picomatch library. Specifically, the analyzeRepeatedExtglob function skips certain pattern checks. This oversight allows exponential backtracking when processing short, crafted strings. The affected versions of Picomatch are all releases up to and including 4.0.7. The micromatch library is also noted as being affected by this issue. The weakness is categorized under CWE-1333 by security researchers.
What changes now
No fix has been confirmed yet for this vulnerability. Users cannot apply a patch to resolve the issue immediately. Teams must monitor vendor announcements for an updated library version. Until a fix is released, exposure remains active for all systems using the affected versions. Administrators should prepare to update their dependencies as soon as a secure version becomes available. Waiting for official guidance is the safest course of action.
Who needs to act first
Teams usually prioritize systems that accept untrusted input from external users. Check whether your public-facing applications use the affected library for processing user data. Isolate these critical systems from less sensitive internal tools during the assessment. Back up configuration files and current codebases before making any changes. Test updates in a staging environment to ensure compatibility. Reduce exposure by limiting input length where possible. Monitor application logs for unusual processing delays or hangs.
What to do and how to stay safe: Picomatch
- Audit your Node.js projects to identify if Picomatch or micromatch versions up to 4.0.7 are installed
- Restrict input fields that might accept glob-like patterns to prevent exploitation attempts
- Monitor application performance metrics for signs of event loop blocking or excessive CPU usage
- Once the vendor provides an update, test the new version in a non-production environment first
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Picomatch are affected by this vulnerability?
All versions of Picomatch up to and including 4.0.7 are affected by CVE-2026-112366.
Is there a patch available for this security flaw?
No fix has been confirmed yet, so users must wait for an official update from the vendor.
How does an attacker exploit this vulnerability?
Attackers supply single-branch repeated extglob patterns like +(*) to block the event loop.
