CVE-2026-33671

A flaw was found in Picomatch, a JavaScript glob matcher. This Regular Expression Denial of Service ReDoS vulnerability allows a remote attacker to cause excessive CPU consumption and block the Node.js event loop, leading to a denial of service. This occurs when untrusted users supply crafted...