GHSA-c2c7-rcm5-vvqj
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 25, 2026
CISA due date
—
The record
Picomatch has a ReDoS vulnerability via extglob quantifiers
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | picomatch | 0 | 2.3.2 |
| npm | picomatch | 3.0.0 | 3.0.2 |
| npm | picomatch | 4.0.0 | 4.0.4 |
| Chainguard | argo-workflows-ui-3.6 | 0 | 3.6.19-r5 |
| Chainguard | argo-workflows-ui-4.0 | 0 | 4.0.3-r2 |
| Chainguard | code-server | 0 | 4.112.0-r2 |
| Chainguard | gemini-cli | 0 | 0.35.3-r0 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.16.0-r11 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r17 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r17 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r20 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r20 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.163.0-r0 |
| Chainguard | lerna | 0 | 9.0.7-r2 |
| Chainguard | node-gyp | 0 | 12.2.0-r2 |
| Chainguard | npm | 0 | 11.12.1-r0 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.5-r3 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r4 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r11 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r8 |
| Chainguard | prism | 0 | 5.14.3-r13 |
| Chainguard | pulumi-language-nodejs | 0 | 3.229.0-r0 |
| Chainguard | rancher-api-ui | 0 | 1.2.3-r8 |
| Chainguard | renovate | 0 | 43.104.7-r1 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r11 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r11 |
| Chainguard | wazuh-dashboard | 0 | 4.14.4-r1 |
| Wolfi | argo-workflows-ui-4.0 | 0 | 4.0.3-r2 |
| Wolfi | code-server | 0 | 4.112.0-r2 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.16.0-r11 |
| Wolfi | lerna | 0 | 9.0.7-r2 |
| Wolfi | node-gyp | 0 | 12.2.0-r2 |
| Wolfi | npm | 0 | 11.12.1-r0 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.5-r3 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r11 |
| Wolfi | prism | 0 | 5.14.3-r13 |
| Wolfi | pulumi-language-nodejs | 0 | 3.229.0-r0 |
| Wolfi | rancher-api-ui | 0 | 1.2.3-r8 |
| Wolfi | renovate | 0 | 43.104.7-r1 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r11 |
Related vulnerabilities
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Same vulnerability
- CVE-2026-33672 Picomatch is a glob matcher written JavaScript. Also affects picomatch
- GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching Also affects picomatch
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects argo-workflows-ui-3.6
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects argo-workflows-ui-3.6
- GHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route… Also affects argo-workflows-ui-3.6
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects argo-workflows-ui-3.6
- GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion Also affects argo-workflows-ui-3.6