Picomatch through version 4.0.7 implements a regular expression parser that can be exploited with specially crafted glob patterns. The flaw occurs when the parser encounters single-branch repeated extglob expressions such as +(*) or +(*a). Because analyzeRepeatedExtglob in lib/parse.js skips these patterns, the regex engine performs exponential backtracking against short strings, which can consume significant CPU time and stall the Node.js event loop. This denial of service affects the availability of any application that relies on picomatch for glob matching, effectively blocking further code execution until resources recover.

The vulnerability affects the picomatch JavaScript package released by micromatch, specifically version 4.0.7 and earlier. Any Node.js application that imports or depends on this package for glob matching is at risk. No other vendors or product versions are listed for this CVE.

The flaw carries a CVSS score of 8.7, indicating a high severity. The EPSS score is not available, so the current probability of exploitation is uncertain, but the lack of a KEV listing does not exclude the possibility of targeted attacks via crafted glob inputs. Attackers would need the ability to supply arbitrary glob patterns to the application, which typically occurs through configurations, user input, or file names in environments that use picomatch. If such an opportunity exists, the exploited backtracking could tie up CPU resources, causing a denial of service to the application or its users. Thus, the risk remains significant primarily in environments where untrusted input is passed to the library without validation.