Attack Chain

1. An attacker identifies an application that utilizes the picomatch library to process user-supplied glob patterns.
2. The attacker crafts a malicious glob pattern containing nested extglobs or extglob quantifiers such as +(a|aa) or +(+(a)).
3. The attacker submits the malicious glob pattern to the vulnerable application.
4. The application passes the attacker-supplied glob pattern to the picomatch library for compilation or matching.
5. Picomatch compiles the malicious glob pattern into an inefficient regular expression.
6. When matching the compiled regex against an input string, catastrophic backtracking occurs due to the regex complexity.
7. CPU consumption spikes as the regex engine struggles to process the input, blocking the Node.js event loop.
8. The application becomes unresponsive, leading to a denial-of-service condition.

Impact

Successful exploitation of this ReDoS vulnerability in picomatch can lead to significant denial-of-service conditions. While the number of affected applications is unknown, any application utilizing picomatch to process untrusted glob patterns is potentially vulnerable. The impact includes excessive CPU consumption, event loop blocking in Node.js applications, and potential service outages, causing disruption and impacting availability. Local testing has shown multi-second delays with short inputs, demonstrating the severity of the issue.

Recommendation

• Upgrade to picomatch version 4.0.4, 3.0.2, or 2.3.2, or a later version depending on the supported release line to patch CVE-2026-33671.
• Implement input validation on any endpoint that accepts glob patterns to reject or sanitize patterns containing nested extglobs or extglob quantifiers such as +() and *() as described in the overview.
• Disable extglob support for untrusted patterns by using noextglob: true as mentioned in the workarounds section.