Regular Expression Denial of Service in micromatch
Priority LOW 33CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 7 fixed, 39 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01429 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial micromatch (micromatch): 4.0.8micromatch (npm): 4.0.8Red Hat: 4 advisoriesRed Hat: 7 fixed, 39 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| micromatch | micromatch | before 4.0.8 | 4.0.8 | Patch available | CNA |
| — | micromatch (npm) | before 4.0.8 | 4.0.8 | Patch available | GHSA-952p-6rrq-rcjv |
- micromatch Vendormicromatch Affected before 4.0.8 Fixed in 4.0.8 Patch available CNA
- micromatch (npm) Vendor— Affected before 4.0.8 Fixed in 4.0.8 Patch available GHSA-952p-6rrq-rcjv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jonschlinkert:micromatch:*:*:*:*:*:node.js:*:* | before 4.0.8 | Vulnerable | micromatch |
- cpe:2.3:a:jonschlinkert:micromatch:*:*:*:*:*:node.js:*:* Versions before 4.0.8 Vulnerable ·micromatch
Remediation
- Fix · CNA micromatch (micromatch) Fixed in 4.0.8
- Fix · GHSA-952p-6rrq-rcjv micromatch (npm) Fixed in 4.0.8 Advisory →
Red Hat 4 advisories
- RHSA-2025:23225 Released 2025-12-15 · Red Hat rating CriticalRed Hat OpenShift Dev Spaces 3.25.0 Release.
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.25 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/openvsx-rhel9, registry.redhat.io/devspaces/pluginregistry-rhel9 +3
- RHSA-2024:10775 Released 2024-12-04 · Red Hat rating ModerateACS 4.6 enhancement and security update
- RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3
- RHSA-2024:8906 Released 2024-11-05 · Red Hat rating CriticalSatellite 6.16.0 release
- Red Hat Satellite 6.16 for RHEL 8 ansible-collection-redhat-satellite-4.2.0-1.el8sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el8sat, ansible-lint-5.4.0-1.el8pc +47
- Red Hat Satellite 6.16 for RHEL 9 ansible-collection-redhat-satellite-4.2.0-1.el9sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el9sat, ansible-runner-2.2.1-5.el9pc +47
Show 1 more Red Hat advisories
- RHSA-2024:6211 Released 2024-09-03 · Red Hat rating ImportantRed Hat OpenShift Service Mesh Containers for 2.6.1 security update
- RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
- RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 2 | Affected | No fix yet |
| Logging Subsystem for Red Hat OpenShift | Affected | — |
| Migration Toolkit for Applications 7 | Affected | — |
| Migration Toolkit for Containers | Affected | — |
| Migration Toolkit for Runtimes | Affected | — |
| Migration Toolkit for Virtualization | Affected | — |
| Network Observability Operator | Affected | — |
| Node HealthCheck Operator | Affected | — |
| OpenShift Pipelines | Affected | — |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2 | Affected | — |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 3 | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | — |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Discovery 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | — |
| Red Hat OpenShift Data Science (RHODS) | Affected | — |
| Red Hat OpenShift Dev Spaces | Affected | — |
| Red Hat OpenShift GitOps | Affected | — |
| Red Hat OpenShift Virtualization 4 | Affected | — |
| Red Hat OpenShift distributed tracing 2 | Affected | — |
| Red Hat OpenShift distributed tracing 3 | Affected | — |
| Red Hat Openshift Container Storage 4 | Affected | — |
| Red Hat Openshift Data Foundation 4 | Affected | — |
| Red Hat Process Automation 7 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | — |
| Red Hat Satellite 6 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| RHACS 4.6 for RHEL 8 | Fixed | RHSA-2024:10775 |
| RHOSSM 2.6 for RHEL 8 | Fixed | RHSA-2024:6211 |
| RHOSSM 2.6 for RHEL 9 | Fixed | RHSA-2024:6211 |
| Red Hat Developer Hub 1.3 for RHEL 9 | Fixed | — |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.25 | Fixed | RHSA-2025:23225 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2024:8906 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2024:8906 |
Not affected: 13 products
- Multicluster Engine for Kubernetes
- RHACS 4.6 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Build of Keycloak
- Red Hat Developer Hub 1.3 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.25
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat build of Apicurio Registry 2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4067
- 2026-10-03 Alias added: GHSA-952p-6rrq-rcjv
- 2026-10-09 Affected versions changed · Red Hat
References
Patch 3
Advisory 2
Other 7
- https://github.com/micromatch/micromatch/releases/tag/4.0.8
- https://github.com/micromatch/micromatch/issues/243
- https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0
- https://advisory.checkmarx.net/advisory/CVE-2024-4067
- https://devhub.checkmarx.com/cve-details/CVE-2024-4067
- https://github.com/micromatch/micromatch
- https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448
Sources
- CVE-2024-4067 · CVE Program
- CVE-2024-4067 · NVD
- FIRST EPSS
- GHSA-952p-6rrq-rcjv · GitHub Advisory Database · CC BY 4.0
- CVE-2024-4067 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences