What’s Vulnerable › Products

micromatch picomatch vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your micromatch picomatch version is affected

Latest micromatch picomatch vulnerabilities

• CVE-2026-112366 — Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns (CVSS 7.5)
• CVE-2026-33672 — Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching (CVSS 5.3)
• CVE-2026-33671 — Picomatch has a ReDoS vulnerability via extglob quantifiers (CVSS 7.5)