micromatch has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.5 (high).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Weakness classes
Products
- braces 1
- picomatch 1
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
micromatch vulnerabilities
CVEs affecting micromatch, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-112366High· 7.5Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), whi…
▾ Twilightmicromatch · picomatchEPSS 0.34%via CVEORG
CVE-2026-93687High· 7.5PoCbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Nod…
▾ Midnightmicromatch · bracesEPSS 0.76%via NVD