CVE-2026-33671

What it actually does

CVE-2026-33671 is a Regular Expression Denial of Service (ReDoS) vulnerability in the JavaScript glob-matching library picomatch. Affected versions compile certain crafted extglob patterns, particularly patterns using quantifiers such as `+()` and `*()` with overlapping alternatives or nested extglobs, into regular expressions that can trigger catastrophic backtracking. When these expressions are evaluated against non-matching input, CPU usage can spike for an extended period. In Node.js applications, this can block the single-threaded event loop and prevent the application from handling other requests, causing denial of service. The risk is highest where applications accept user-controlled glob patterns and pass them directly to picomatch for compilation or matching.

Why it matters to the business

Successful exploitation can make affected Node.js services slow or unavailable by exhausting CPU resources. Public-facing features that allow users to search, filter, match file paths, configure rules, upload patterns, or define glob-based selectors are the most exposed. While there is no direct confidentiality or integrity impact, downtime can disrupt customer-facing services, CI/CD workflows, build systems, developer tooling, content processing, or automation platforms that depend on picomatch. The vulnerability has a high availability impact, but it is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, so remediation should be prioritized based on whether untrusted users can supply glob patterns.

How an attack unfolds

An attacker first identifies an application endpoint, API, configuration field, or workflow that accepts glob-style patterns and uses picomatch to evaluate them. The attacker submits a specially crafted extglob pattern containing constructs such as `+()` or `*()`, often with nested groups or overlapping alternatives. The vulnerable picomatch version compiles that pattern into a JavaScript regular expression with pathological backtracking behavior. The attacker then causes the application to match the compiled expression against input that does not match or only fails after extensive evaluation. This forces the Node.js process to spend excessive CPU time inside regular expression evaluation. Because Node.js commonly relies on a single event loop per process, the process may stop responding to other requests until the regex evaluation completes or the process is restarted. Repeating the request can sustain denial of service.

How to fix it

Upgrade picomatch to a fixed release: 4.0.4 or later for the 4.x line, 3.0.2 or later for the 3.x line, or 2.3.2 or later for the 2.x line. Because picomatch is commonly pulled in transitively through build tools and JavaScript packages, review lockfiles and dependency trees, then refresh pinned dependencies where needed. If an immediate upgrade is not possible, do not pass untrusted user input directly to picomatch. For untrusted patterns, disable extglob handling with `noextglob: true` where compatible with application requirements. Add validation or allowlists that reject nested extglobs, overlapping alternatives, and extglob quantifiers such as `+()` and `*()`. Consider running pattern compilation and matching in a worker thread or separate process with CPU, memory, and execution-time limits. Apply request throttling, payload size limits, and input validation on any endpoint that accepts glob patterns.

How to confirm the fix worked

Confirm the installed picomatch version is 4.0.4 or later, 3.0.2 or later, or 2.3.2 or later, depending on the release line in use. Use package manager tooling such as `npm ls picomatch`, `yarn why picomatch`, `pnpm why picomatch`, and lockfile review to identify direct and transitive copies. Verify container images, serverless bundles, CI runners, and packaged application artifacts do not include vulnerable versions. Review code paths to confirm that untrusted input is not passed to picomatch without validation. Where mitigations are used, test that patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()` are rejected or handled with `noextglob: true`. Performance-test representative worst-case pattern inputs in a non-production environment to ensure requests are bounded by timeouts or resource limits and do not block the Node.js event loop.

Typical attack path

1. Discover an application feature that accepts user-supplied glob patterns, such as search filters, path matchers, rule definitions, ignore/include lists, or project configuration inputs.
2. Submit a crafted extglob pattern using constructs such as `+()` or `*()`, especially with nested groups or overlapping alternatives.
3. Trigger the application to compile or evaluate the pattern using a vulnerable picomatch version.
4. Ensure the pattern is matched against a non-matching or worst-case input string that causes catastrophic backtracking.
5. Repeat requests or submit multiple patterns to keep CPU usage high and block the Node.js event loop.
6. Cause the affected service, worker, build process, or API endpoint to become slow, unresponsive, or unavailable.

How to detect it

Look for evidence of denial-of-service attempts against endpoints or workflows that accept glob patterns, file path filters, include/exclude rules, or search expressions. Useful log sources include HTTP access logs, API gateway logs, WAF logs, application request logs, Node.js process logs, APM traces, container metrics, host CPU metrics, event-loop lag telemetry, and process supervisor restart logs. Search for request parameters or JSON fields containing dense extglob syntax, especially repeated `+(`, `*(`, nested parentheses, pipe-separated alternatives, and long non-matching strings. Correlate these requests with sudden CPU spikes, increased event-loop lag, request timeouts, elevated 5xx responses, pod/container restarts, Node.js process restarts, or autoscaling events. Because this vulnerability does not normally create files, spawn malware, or leave a unique post-exploitation artifact, detection relies primarily on identifying suspicious pattern inputs and associated availability symptoms.

• +(*)
• *(*)
• +(
• *(
• @(
• ?(
• !(
• noextglob
• picomatch
• event loop lag
• JavaScript heap out of memory
• FATAL ERROR
• Ineffective mark-compacts near heap limit
• Maximum call stack size exceeded
• ETIMEDOUT
• ECONNRESET
• HTTP 503
• HTTP 504

What your security team should do

• Inventory all applications and tooling that include picomatch, including transitive dependencies in Node.js projects and packaged build artifacts.
• Prioritize remediation for internet-facing or multi-tenant services where users can submit glob patterns, file path filters, rule definitions, or project configuration values.
• Upgrade to picomatch 4.0.4+, 3.0.2+, or 2.3.2+ according to the supported dependency line, and regenerate lockfiles.
• Add server-side validation for any user-controlled glob pattern and reject high-risk extglob constructs such as nested extglobs, `+()`, and `*()` unless explicitly required.
• Use `noextglob: true` for untrusted pattern matching where extglob functionality is not necessary.
• Apply rate limiting, request size limits, execution timeouts, and worker/process isolation around pattern compilation and matching.
• Monitor Node.js services for CPU saturation, event-loop lag, request timeouts, and repeated requests containing suspicious glob syntax.
• Search logs for suspicious extglob-heavy inputs and correlate them with spikes in CPU usage, 5xx errors, latency, process restarts, or autoscaling events.