AIKIDO-2026-334325
wcmatch is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
wcmatchTL;DR
wcmatch translates extended glob patterns, enabled through the EXTMATCH or EXTGLOB flag, into regular expressions. When it parses patterns containing long chains of unbalanced or improperly nested opening extended-glob brackets, the parser repeatedly discards partially parsed content and restarts validation, producing exponential-time backtracking that worsens with nesting. A short externally influenced pattern of only tens of characters can exhaust CPU and hang the process. The fix reduces nested extended-glob structures and halts parsing once an unclosed extended group is encountered.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable extended glob matching via the EXTMATCH or EXTGLOB flag and evaluate user-controlled or externally influenced glob patterns.
Background info
wcmatch is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 10.2.1.
How to fix this
Upgrade the wcmatch library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant