Issue Station
Sign In
Tools hereToolbox

nextjs - 💡(How to fix) Fix Bundled picomatch (dist/compiled/picomatch) stuck on 4.0.3 — CVE-2026-33671 HIGH flagged by Trivy [1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
vercel/next.js#92950•Fetched 2026-04-18 05:51:15
View on GitHub
Comments
1
Participants
1
Timeline
3
Reactions
0
Author
BeLazy167BeLazy167
Participants
BeLazy167BeLazy167
Timeline (top)
labeled ×2commented ×1

Root Cause

Adding "overrides": { "picomatch": "4.0.4" } to package.json correctly bumps node_modules/picomatch/ to 4.0.4 but does NOT touch node_modules/next/dist/compiled/picomatch/, because the latter is bundled inside Next's own tarball.

Fix Action

Fix / Workaround

Expected: A Next patch release that re-vendors dist/compiled/picomatch/ from picomatch ≥ 4.0.4, so downstream consumers pick it up on normal npm install without needing .trivyignore / patch-package workarounds.

Bundled code at node_modules/next/dist/compiled/picomatch/index.js matches the 4.0.3 signature (the isWindows() runtime check was introduced in 4.0.3; the ReDoS patch arrived in 4.0.4).

This is a supply-chain tracking request, not a runtime bug — .trivyignore is the available workaround but it suppresses the finding for the reachable top-level picomatch too, which is not ideal.

Code Example

picomatch (package.json) | CVE-2026-33671 | HIGH | fixed | 4.0.3 | 4.0.4
RAW_BUFFERClick to expand / collapse

Link to the code that reproduces this issue

https://github.com/BeLazy167/next-picomatch-cve-repro

To Reproduce

  1. git clone https://github.com/BeLazy167/next-picomatch-cve-repro && cd next-picomatch-cve-repro
  2. npm install
  3. cat node_modules/next/dist/compiled/picomatch/package.json — name says picomatch, version field is stripped but Trivy identifies it as 4.0.3
  4. docker build -t repro . && trivy image repro

Result:

picomatch (package.json) | CVE-2026-33671 | HIGH | fixed | 4.0.3 | 4.0.4

Adding "overrides": { "picomatch": "4.0.4" } to package.json correctly bumps node_modules/picomatch/ to 4.0.4 but does NOT touch node_modules/next/dist/compiled/picomatch/, because the latter is bundled inside Next's own tarball.

Current vs. Expected behavior

Current: Next 16.2.4 (latest at time of filing) ships picomatch 4.0.3 internally at dist/compiled/picomatch/index.js. picomatch 4.0.3 is affected by CVE-2026-33671 (ReDoS via crafted extglob patterns). Container/filesystem scanners (Trivy, Grype, Snyk) flag the bundled copy HIGH and fail security-gated CI pipelines, even for apps that have correctly pinned the top-level picomatch to 4.0.4 via overrides.

Expected: A Next patch release that re-vendors dist/compiled/picomatch/ from picomatch ≥ 4.0.4, so downstream consumers pick it up on normal npm install without needing .trivyignore / patch-package workarounds.

Verbose

Bundled code at node_modules/next/dist/compiled/picomatch/index.js matches the 4.0.3 signature (the isWindows() runtime check was introduced in 4.0.3; the ReDoS patch arrived in 4.0.4).

SHA1 of the bundled file on a fresh install: 6e92069f5eef59717a569d8d5c6ca5faa31f0c59 (23,905 bytes).

Which area(s) are affected? (Select all that apply)

Output, Standalone mode, Middleware, Runtime

Which stage(s) are affected? (Select all that apply)

next build (local), next start (local), Other (Deployed)

Additional context

This is a supply-chain tracking request, not a runtime bug — .trivyignore is the available workaround but it suppresses the finding for the reachable top-level picomatch too, which is not ideal.

extent analysis

TL;DR

The most likely fix is to wait for a Next.js patch release that updates the bundled picomatch version to 4.0.4 or later.

Guidance

  • The issue is caused by the bundled picomatch version in Next.js being outdated and vulnerable to CVE-2026-33671.
  • To verify the issue, check the node_modules/next/dist/compiled/picomatch/index.js file for the isWindows() runtime check, which was introduced in picomatch 4.0.3.
  • As a temporary workaround, consider using .trivyignore to suppress the vulnerability finding, but be aware that this will also suppress findings for the top-level picomatch package.
  • Monitor the Next.js release notes for a patch release that updates the bundled picomatch version.

Notes

The issue is specific to the bundled picomatch version in Next.js and does not affect the top-level picomatch package. The workaround using .trivyignore has limitations, as it suppresses findings for both the bundled and top-level packages.

Recommendation

Apply the workaround using .trivyignore until a Next.js patch release is available that updates the bundled picomatch version to 4.0.4 or later. This will allow you to continue using Next.js while mitigating the vulnerability finding.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#autograd error#model save/load#optimization#mixed precision#training loop

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

nextjs - 💡(How to fix) Fix Bundled picomatch (dist/compiled/picomatch) stuck on 4.0.3 — CVE-2026-33671 HIGH flagged by Trivy [1 comments, 1 participants]