next-picomatch-cve-repro

Next.js 捆绑的 picomatch CVE-2026-33671 复现 针对以下问题的极简复现：Next.js 16.2.4 内置了 picomatch 4.0.3，位于 nodemodules/next/dist/compiled/picomatch/，该版本受 CVE-2026-33671 （高危）影响。npm 的 overrides 无法触及捆绑副本。 步骤 npm install 1. 检查内置副本 cat nodemodules/next/dist/compiled/picomatch/package.json →...

Security Bulletin: Threat Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Threat Intelligence App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

Security Bulletin: QRadar Deployment Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. QRadar Deployment Intelligence for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axio...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the packages picomatch-2.3.1.tgz.

Summary Impacted IBM Optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the packages picomatch-2.3.1.tgz. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob...

ROOT-APP-NPM-CVE-2026-33671 CVE-2026-33671 in picomatch - Patched by Root

Root has patched CVE-2026-33671 in the picomatch package for Root:npm. Multiple fixed versions available...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to picomatch-2.2.2.tgz (CVE-2026-33671, CVE-2026-33672)

Summary picomatch is vulnerable to a Inefficient Regular Expression Complexity DOS, Improperly Controlled Modification of Object Prototype Attributes / Prototype Reference attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

CLSA-2026-1784596322 TuxCare security update for picomatch (2 CVEs)

TuxCare rebuilt picomatch to address 2 CVEs. Fixed in 4.0.1-tuxcare.1...

CLSA-2026-1778805972 TuxCare security update for picomatch (2 CVEs)

TuxCare rebuilt picomatch to address 2 CVEs. Fixed in 4.0.2-tuxcare.1...

CLSA-2026-1778805973 TuxCare security update for picomatch (2 CVEs)

TuxCare rebuilt picomatch to address 2 CVEs. Fixed in 2.3.1-tuxcare.1...

ROOT-APP-NPM-CVE-2026-33672 CVE-2026-33672 in @rootio/picomatch - Patched by Root

Root has patched CVE-2026-33672 in the @rootio/picomatch package for Root:npm. Multiple fixed versions available...

The vulnerability of the library for filtering file paths in Picomatch, which stems from the use of a regular expression c with inefficient computational complexity, allows attackers to trigger a service failure.

The vulnerability of the library for filtering file paths in Picomatch is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow an attacker operating remotely to cause service interruptions...

The vulnerability of the Picomatch library lies in the uncontrolled modification of object prototype attributes, which allows attackers to compromise data integrity.

The vulnerability of the Picomatch library is related to uncontrolled changes to the attributes of the object’s prototype. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub. flatted-3.3.3.tgz , axios-1.15.1.tgz, immutable-4.0.0-rc.12.tgz , lodash-4.17.23.tgz, jspdf-3.0.2.tgz , swiper-11.2.10.tgz , picomatch-2.3.1.tgz , axios-1.12.2.tgz , router-1.23.0.tgz , minimatch-10.2.1.tgz ,...

Security Bulletin: Vulnerabilities in Spring, Tomcat, Netty, Picomatch might affect IBM Storage Protect Plus

Summary IBM Storage Protect Plus can be affected by vulnerabilities in Spring, Tomcat, Netty, Picomatch . Vulnerabilities include stack-based buffer overflow, improper encoding or escaping of output, deserialization of untrusted data, improper restriction of operations within the bounds of a memo...

Security Bulletin: Vulnerability in Picomatch affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Picomatch has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Regular Expression Denial of Service.

Summary picomatch-2.3.1.tgz is used by IBM Sterling Connect:Direct Web Services CVE-2026-33671, CVE-2026-33672. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-3505, CVE-2025-14813, CVE-2026-0636, CVE-2026-5598, CVE-2026-33671, CVE-2026-33672, CVE-2026-5588, CVE-2026-40175)

Summary IBM Rational Developer for i is affected by an uncontrolled resource consumption vulnerability in Bcpg CVE-2026-3505, a broken or risky cryptographic vulnerability in Bcprov CVE-2025-14813, an LDAP injection vulnerability in Bcprov CVE-2026-0636, a covert timing channel vulnerability in...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses minimatch-3.0.5.tgz, OpenTelemetry Go SDK, jaraco.context, IBM WebSphere Application Server Liberty, picomatch-2.3.1.tgz, path-to-regexp-0.1.12.tgz, lodash-4.17.23.tgz, pillow-12.1.1-cp311-cp311-manylinux227x8664.manylinux228x8664.whl,...

Security Bulletin: Multiple vulnerabilities in IBM Security QRadar EDR Software

Summary Multiple vulnerabilities were addressed in IBM Security QRadar EDR Software version 3.12.25 Vulnerability Details CVEID:CVE-2026-30951 DESCRIPTION: Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses picomatch-2.3.1.tgz, picomatch-4.0.3.tgz which is vulnerable to CVE-2026-33671, CVE-2026-33672

Summary IBM Maximo Application Suite - Visual Inspection component uses picomatch-2.3.1.tgz, picomatch-4.0.3.tgz which is vulnerable to CVE-2026-33671, CVE-2026-33672 , This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-33671...