Micromatch

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 7.5HighOct 19, 2026Micromatch picomatch Denial of serviceCVE-2026-112366Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
• 7.5HighSep 18, 2026Micromatch braces Denial of serviceCVE-2026-93687braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
• 7.5HighMay 13, 2024Micromatch bracesCVE-2024-4068The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating 1.5% likely
• 5.3MediumMay 13, 2024micromatch Denial of serviceCVE-2024-4067The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtrackin1.4% likely

See every Micromatch entry on the dashboard.

Top products

• picomatch1 CVE in the last year
• braces1 CVE in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• Atlassian · Dec 10, 2024Atlassian Security Bulletin December 10, 2024CVE-2024-4067
• Atlassian · Nov 19, 2024Atlassian Security Bulletin November 19, 2024CVE-2024-4068