The vulnerability is a Regular Expression Denial of Service in picomatch caused by catastrophic backtracking when processing crafted extglob quantifiers such as +() and *(). A malicious or malformed pattern can consume large amounts of CPU and block the Node.js event loop, resulting in an unavailable service. The weakness is a ReDoS issue (CWE‑1333).

The flaw affects micromatch:picomatch versions prior to 4.0.4, 3.0.2, and 2.3.2. Any Node.js application that accepts glob patterns from users and passes them directly to picomatch is potentially impacted.

The CVSS score is 7.5 and the EPSS score is less than 1 %, indicating a moderate severity but low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted pattern to the application, which may be trivial if user input is not validated or sanitized. Once triggered, the attack can cause significant performance degradation and denial of availability.