nextjs - 💡(How to fix) Fix Bundled picomatch (dist/compiled/picomatch) still on 4.0.3 — flagged HIGH by Trivy (CVE-2026-33671) [1 comments, 2 participants]

Describe the bug

Next.js 16.2.4 (latest) ships with picomatch vendored at node_modules/next/dist/compiled/picomatch/index.js, pinned to 4.0.3.

picomatch 4.0.3 is affected by CVE-2026-33671 (HIGH) — Regular Expression Denial of Service via crafted extglob patterns. Fixed upstream in picomatch 4.0.4.

Since the copy is bundled into Next's tarball, downstream package.json overrides / resolutions cannot reach it. Trivy scans the bundled package.json path and reports the CVE, which is failing security-gated Cloud Build / CI pipelines on apps using Next.js.

Expected behavior

node_modules/next/dist/compiled/picomatch/ reflects picomatch >= 4.0.4 so the CVE no longer shows up in container image scans.

Reproduction

$ npx create-next-app@latest demo
$ cd demo
$ cat node_modules/next/dist/compiled/picomatch/package.json
{"name":"picomatch","main":"index.js",...}
# (version field is stripped, but Trivy identifies it as 4.0.3)

$ trivy fs --scanners vuln .
# → CVE-2026-33671 HIGH on app/node_modules/next/dist/compiled/picomatch/package.json

Workaround

For now, downstream consumers either:

1. Add CVE-2026-33671 to .trivyignore (hides a real HIGH for the reachable top-level picomatch too), OR
2. Use patch-package to post-install overwrite dist/compiled/picomatch/index.js with a shim to the top-level require('picomatch') — fragile, breaks standalone traces.

Neither is ideal — a Next release that re-bundles picomatch 4.0.4 is the right fix.

Which area(s) are affected?

Create (next-app)
Runtime (bundled deps)

Which stage(s) are affected?

next build, next start, standalone output

Additional context

• Next.js version: 16.2.4
• picomatch (vendored): 4.0.3
• picomatch (fixed): 4.0.4
• CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-33671
• picomatch release: https://github.com/micromatch/picomatch/releases/tag/4.0.4