CVE catalog
CVE-2024-4067
node-micromatch: CVE-2024-4067
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.43% · Oct 25, 2026
The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-micromatch | sid | 4.0.8+~4.0.10-2 | fixed |
| Debian | node-micromatch | forky | 4.0.8+~4.0.10-2 | fixed |
| Debian | node-micromatch | trixie | 4.0.7+~4.0.9-1 | fixed |
| Debian | node-micromatch | bookworm | 4.0.5+~4.0.2-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-micromatch | source | sid | 4.0.7+~4.0.7-1 | not yet assigned | Not reported | [1071631] |
| Debian | node-micromatch | source | forky | 4.0.7+~4.0.7-1 | not yet assigned | Not reported | [1071631] |
| Debian | node-micromatch | source | trixie | 4.0.7+~4.0.7-1 | not yet assigned | Not reported | [1071631] |
| Debian | node-micromatch | source | bookworm | (unfixed) | not yet assigned | Not reported | [1071631] |
Notes
[bookworm] node-micromatch: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_3771-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-4067]
- [https://security-tracker.debian.org/tracker/CVE-2024-4067]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-4067.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2036.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]