next-picomatch-cve-repro

Next.js bundled picomatch CVE-2026-33671 repro Minimal reproduction for: Next.js 16.2.4 ships with picomatch 4.0.3 vendored at nodemodules/next/dist/compiled/picomatch/, which is affected by CVE-2026-33671 HIGH. npm overrides cannot reach the bundled copy. Steps npm install 1. Inspect the vendore...

CLEANSTART-2026-AB74682 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the argo-workflows package. Picomatch is a glob matcher written JavaScript...

CLEANSTART-2026-HR70572 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the argo-workflows package. Picomatch is a glob matcher written JavaScript...

ROOT-APP-NPM-CVE-2026-33672 CVE-2026-33672 in picomatch - Patched by Root

Root has patched CVE-2026-33672 in the picomatch package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33671 CVE-2026-33671 in picomatch - Patched by Root

Root has patched CVE-2026-33671 in the picomatch package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-112366 CVE-2026-112366 in picomatch - Patched by Root

Root has patched CVE-2026-112366 in the picomatch package for Root:npm. Multiple fixed versions available...

Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Apache WSS4J, Apache XmlSchema, and picomatch.

Summary IBM ApplinX is vulnerable to multiple vulnerabilities due to use of third-party libraries: Apache WSS4J wss4j-ws-security-common and wss4j-ws-security-dom is vulnerable to improper authentication, insufficient verification of data authenticity, authentication bypass by spoofing, improper...

CLEANSTART-2026-SO65799 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the npm package. Picomatch is a glob matcher written JavaScript...

CLEANSTART-2026-PO48761 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the npm package. Picomatch is a glob matcher written JavaScript...

CLEANSTART-2026-DE87336 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the argo-workflows package. Picomatch is a glob matcher written JavaScript...

CLEANSTART-2026-LP66230 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the argo-workflows package. Picomatch is a glob matcher written JavaScript...

CLEANSTART-2026-HF83772 Picomatch is a glob matcher written JavaScript

CVE-2026-33672 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-ZY80781 Picomatch is a glob matcher written JavaScript

CVE-2026-33671 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details...

CLSA-2026-1793205291 TuxCare security update for picomatch (2 CVEs)

TuxCare rebuilt picomatch to address 2 CVEs. Fixed in 4.0.3-tuxcare.1...

SUSE CVE-2026-112366

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like + or +a, which analyzeRepeatedExtglob in lib/parse.js skips, causing exponenti...

CLEANSTART-2026-LA61588 Picomatch is a glob matcher written JavaScript

CVE-2026-33672 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-JT00262 Picomatch is a glob matcher written JavaScript

CVE-2026-33671 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details...

Linux Distros Unpatched Vulnerability : CVE-2026-112366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch...

CVE-2026-112366

A flaw was found in picomatch. A remote attacker can trigger this vulnerability by supplying crafted pattern-matching inputs containing single-branch repeated extglob expressions. Processing these inputs causes exponential regular expression backtracking, which blocks the event loop and leads to ...

AZL-110085 CVE-2026-112366 affecting package python-tensorboard 2.16.2-6

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like + or +a, which analyzeRepeatedExtglob in lib/parse.js skips, causing exponenti...