porro

Log in Start free trial

Advisories / npm

npm

picomatch

Security advisories for picomatch, newest first. 2 known, all fixed. If you’re on 4.0.4 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

4.0.7

Advisories

2 · 0 unfixed

Last advisory

25 Mar 2026

Safe from

4.0.4

2 advisories · newest first

MODERATE5.3 25 Mar 2026

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

GHSA-3v7f-55p6-f55p · CVE-2026-33672

Affected

≥ 3.0.0, < 3.0.2 ≥ 4.0.0, < 4.0.4

Fixed in

3.0.2 4.0.4

Published

25 Mar 2026

HIGH7.5 25 Mar 2026

Picomatch has a ReDoS vulnerability via extglob quantifiers

GHSA-c2c7-rcm5-vvqj · CVE-2026-33671

Affected

≥ 3.0.0, < 3.0.2 ≥ 4.0.0, < 4.0.4

Fixed in

3.0.2 4.0.4

Published

25 Mar 2026

/advisories/npm/picomatch/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →