CVE-2026-33671: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33671 is a Regular Expression Denial of Service (ReDoS) vulnerability in the picomatch npm package, caused by catastrophic backtracking when processing crafted extglob patterns. It was published on March 23, 2026, and affects picomatch versions before 2.3.2, 3.0.0–3.0.1, and 4.0.0–4.0.3. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory). Downstream products from IBM and Microsoft (Azure Linux Node.js 24) are also affected (Feedly).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity). The vulnerability exists in lib/parse.js and lib/constants.js, where extglob quantifiers such as +() and *() — especially when combined with overlapping alternatives or nested extglobs — are compiled into regular expressions that exhibit catastrophic backtracking on non-matching input (GitHub Advisory). For example, +(a|aa) compiles to ^(?:(?=.)(?:a|aa)+)$ and takes approximately 2 seconds to reject a 41-character non-matching input, while nested patterns like +(+(a)) and *(+(a)) took around 29 seconds to reject a 33-character input on a modern M1 MacBook (picomatch Advisory). Exploitation requires that an application passes untrusted user-supplied glob patterns to picomatch for compilation or matching; applications using only developer-controlled patterns are not meaningfully exposed. The fix introduces a maxExtglobRecursion option (defaulting to 0) that treats risky quantified extglobs as literals rather than compiling them to regex (picomatch Commit).

Successful exploitation causes excessive CPU consumption and blocks the Node.js event loop, resulting in denial of service for the affected application. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Applications accepting user-supplied glob patterns (e.g., file search, filtering APIs) are at risk of becoming unresponsive or timing out under attack, potentially affecting all users of the service (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.04% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no privileges, and no user interaction, making it trivially exploitable in any application that exposes glob pattern input to untrusted users.

1. Identify a vulnerable target: Find a Node.js application that accepts user-supplied glob patterns and passes them to picomatch (versions < 2.3.2, 3.0.0–3.0.1, or 4.0.0–4.0.3) for compilation or matching — such as a file search API or filter endpoint.
2. Craft a malicious extglob pattern: Construct a pattern that triggers catastrophic backtracking, such as +(a|aa), +(*|?), +(+(a)), *(+(a)), or +(+(+(a))). These patterns compile to regex forms with exponential worst-case complexity.
3. Submit the pattern: Send the crafted pattern as input to the vulnerable endpoint (e.g., via an HTTP request parameter, API call, or form field).
4. Trigger event-loop blocking: The picomatch library compiles the pattern to a vulnerable regex and attempts to match it against a non-matching input string. The regex engine enters catastrophic backtracking, consuming CPU for seconds to tens of seconds per request.
5. Achieve denial of service: By sending repeated requests with such patterns, the attacker saturates the Node.js event loop, causing the application to become unresponsive for all users (GitHub Advisory, picomatch Advisory).

• Logs: Sudden spike in request processing times for endpoints that accept glob pattern input; Node.js event loop lag metrics exceeding several seconds.
• Process: Sustained high CPU usage by the Node.js process without a corresponding increase in throughput; worker threads or the main event loop appearing blocked or unresponsive.
• Network: Repeated requests to glob-accepting API endpoints containing patterns with extglob quantifiers such as +(, *(, or deeply nested combinations like +(+( in query parameters or request bodies.
• Application Monitoring: Increased timeout errors or 503 responses from the application coinciding with receipt of unusual glob pattern inputs.

Upgrade picomatch to a patched version: 2.3.2 (for the 2.x line), 3.0.2 (for the 3.x line), or 4.0.4 (for the 4.x line) (GitHub Advisory, picomatch Commit). If immediate upgrade is not possible, apply one or more of the following workarounds: disable extglob support for untrusted patterns using the noextglob: true option; reject or sanitize patterns containing +(), *(), or nested extglobs; enforce strict allowlists for accepted pattern syntax; run matching in an isolated worker or separate process with time and resource limits; or apply application-level request throttling and input validation on any endpoint that accepts glob patterns (picomatch Advisory). IBM has issued patches for multiple affected products including Watsonx BI Assistant, Application Modernization Accelerator, Process Mining, Guardium Data Security Center, and others (IBM Process Mining, IBM Guardium).

The vulnerability was credited to researcher ByamB4 (finder) with remediation by danez and doowb from the picomatch maintainer team (GitHub Advisory). The advisory references comparable ReDoS precedents CVE-2024-4067 (micromatch) and CVE-2024-45296 (path-to-regexp), situating this issue within a broader pattern of ReDoS vulnerabilities in JavaScript glob and routing libraries. Community discussion was noted on Mastodon and Bluesky, and a reproduction repository was published on GitHub (Feedly). IBM issued multiple security bulletins across its product portfolio acknowledging the vulnerability as a third-party dependency risk.