CVE-2024-4067

The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.

• CWE-1333

• https://advisory.checkmarx.net/advisory/CVE-2024-4067/Exploit, Third Party Advisory
• https://devhub.checkmarx.com/cve-details/CVE-2024-4067/Third Party Advisory
• https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2adePatch
• https://github.com/micromatch/micromatch/pull/266Issue Tracking, Patch
• https://github.com/micromatch/micromatch/releases/tag/4.0.8Release Notes
• https://devhub.checkmarx.com/cve-details/CVE-2024-4067/Third Party Advisory
• https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448Product
• https://github.com/micromatch/micromatch/issues/243Issue Tracking
• https://github.com/micromatch/micromatch/pull/247Issue Tracking, Patch

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4066A vulnerability classified as critical has been found in Ten…8.8
• CVE-2024-40660In setTransactionState of SurfaceFlinger.cpp, there is a pos…7.8
• CVE-2024-40661In mayAdminGrantPermission of AdminRestrictedPermissionsUtil…7.8
• CVE-2024-40662In scheme of Uri.java, there is a possible way to craft a ma…7.8
• CVE-2024-40664In setupAccessibilityServices of AccessibilityFragment.java …6.2
• CVE-2024-40669In TBD of TBD, there is a possible use after free due to a r…8.4
• CVE-2024-40670In TBD of TBD, there is a possible use after free due to a r…8.4
• CVE-2024-40671In DevmemIntChangeSparse2 of devicemem_server.c, there is a …7.8
• CVE-2024-40672In onCreate of ChooserActivity.java, there is a possible way…8.4
• CVE-2024-40673In Source of ZipFile.java, there is a possible way for an at…6.5
• CVE-2024-40674In validateSsid of WifiConfigurationUtil.java, there is a po…5.3
• CVE-2024-40675In parseUriInternal of Intent.java, there is a possible infi…7.5