BeLazy167/next-picomatch-cve-repro

PoC

Minimal repro for Next.js 16.2.4 bundling picomatch 4.0.3 (CVE-2026-33671)

view exploit source poc_in_githubauthor BeLazy167published 2026-04-17catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-33671US	—	0.51% (42nd)	Exploit	2026-03-26
Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted ext…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.