Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable     to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns     using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives     or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on     non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that     are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU     consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use     trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.
    This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or     later, depending on their supported release line. If upgrading is not immediately possible, avoid passing     untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for     untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs     or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax,     running matching in an isolated worker or separate process with time and resource limits, and applying     application-level request throttling and input validation for any endpoint that accepts glob patterns.
    (CVE-2026-33671)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable
    to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns
    using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives
    or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on
    non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that
    are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU
    consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use
    trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.
    This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or
    later, depending on their supported release line. If upgrading is not immediately possible, avoid passing
    untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for
    untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs
    or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax,
    running matching in an isolated worker or separate process with time and resource limits, and applying
    application-level request throttling and input validation for any endpoint that accepts glob patterns.
    (CVE-2026-33671)

ID	Name	Product	Family	Severity
303991	Linux Distros Unpatched Vulnerability : CVE-2026-33671	Nessus	Misc.	high
439235	SCA: security update for picomatch (GHSA-c2c7-rcm5-vvqj)	Tenable Cloud Security	SCA Checks	high
439235	SCA: security update for picomatch (GHSA-c2c7-rcm5-vvqj)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-33671

high

Tenable Plugins

high

high

high