next-picomatch-cve-repro

Next.js bundled picomatch CVE-2026-33671 repro Minimal reproduction for: Next.js 16.2.4 ships with picomatch 4.0.3 vendored at nodemodules/next/dist/compiled/picomatch/, which is affected by CVE-2026-33671 HIGH. npm overrides cannot reach the bundled copy. Steps npm install 1. Inspect the vendore...