Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 9.2.22 or 9.3.x prior to 10.2.14. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- Multiple server-side request forgery (SSRF) vulnerabilities in the bundled axios dependency. (CVE-2026-42043, CVE-2025-62718, CVE-2026-40175, CVE-2026-44492)

- A remote code execution vulnerability in the bundled lodash dependency. (CVE-2026-4800)

- A HTTP request smuggling vulnerability in the bundled Eclipse Jetty dependency. (CVE-2026-2332)

- A prototype pollution vulnerability in the bundled axios dependency. (CVE-2026-42264)

- Multiple injection vulnerabilities in the bundled axios dependency. (CVE-2026-44494, CVE-2026-44490, CVE-2026-42041, CVE-2026-42035, CVE-2026-42033)

- A remote code execution vulnerability in the bundled form-data dependency. (CVE-2026-12143)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-44487, CVE-2026-44486)

- A file inclusion vulnerability in the bundled node-tar dependency. (CVE-2026-31802)

- An information disclosure vulnerability in Atlassian Confluence. (CVE-2026-21579)

- A denial of service vulnerability in the bundled serialize-javascript dependency. (CVE-2026-34043)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-42583, CVE-2026-42587)

- Multiple denial of service vulnerabilities in the bundled axios dependency. (CVE-2026-44496, CVE-2026-44488)

- A file inclusion vulnerability in the bundled fast-uri dependency. (CVE-2026-6321)

- An injection vulnerability in the bundled fast-uri dependency. (CVE-2026-6322)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A denial of service vulnerability in the bundled picomatch dependency. (CVE-2026-33671)

- A denial of service vulnerability. (CVE-2026-48779)

- A denial of service vulnerability in Atlassian Confluence. (CVE-2026-21577)

- A remote code execution vulnerability in the bundled axios dependency. (CVE-2026-44495)

- An injection vulnerability in the bundled logback dependency. (CVE-2025-11226)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable     to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns     using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives     or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on     non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that     are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU     consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use     trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.
    This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or     later, depending on their supported release line. If upgrading is not immediately possible, avoid passing     untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for     untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs     or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax,     running matching in an isolated worker or separate process with time and resource limits, and applying     application-level request throttling and input validation for any endpoint that accepts glob patterns.
    (CVE-2026-33671)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable
    to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns
    using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives
    or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on
    non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that
    are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU
    consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use
    trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.
    This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or
    later, depending on their supported release line. If upgrading is not immediately possible, avoid passing
    untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for
    untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs
    or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax,
    running matching in an isolated worker or separate process with time and resource limits, and applying
    application-level request throttling and input validation for any endpoint that accepts glob patterns.
    (CVE-2026-33671)

ID	Name	Product	Family	Type	Severity
115694	Atlassian Confluence 9.3.x < 10.2.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115693	Atlassian Confluence < 9.2.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
303991	Linux Distros Unpatched Vulnerability : CVE-2026-33671	Nessus	Misc.	Local	high
439235	SCA: security update for picomatch (GHSA-c2c7-rcm5-vvqj)	Tenable Cloud Security	SCA Checks	Local	high
439235	SCA: security update for picomatch (GHSA-c2c7-rcm5-vvqj)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-33671

high

Tenable Plugins

high

high

high

high

high