Next.js Vendored picomatch Vulnerable Dependency — CVE-2026-33671

Metadata

Affected Target

Summary

Next.js 16.2.4 vendors a copy of the picomatch glob-matching library inside its own compiled output at node_modules/next/dist/compiled/picomatch/, pinned to version 4.0.3, which is affected by CVE-2026-33671. Because the vendored copy has its package.json version field stripped and lives inside Next’s own bundled code rather than as a normal top-level dependency, standard remediation via npm overrides cannot reach it — only the directly-installed picomatch gets bumped, while the vendored copy silently remains vulnerable. This repo is a minimal Next.js app used to demonstrate the problem: install, build, containerize, and scan with Trivy to show the CVE is still flagged in the image even after applying an overrides entry. It is a supply-chain/dependency-hygiene repro rather than a functional remote exploit — it proves detection tooling still surfaces the risk and that consumers cannot silence it themselves.

Vulnerability Details

Root Cause

Next.js bundles a stale, vulnerable version of picomatch inside its compiled distribution artifacts instead of resolving it through normal npm dependency resolution, so downstream overrides/resolutions fields in a consumer’s package.json cannot patch the vendored copy.

Attack Vector

1. Install Next.js 16.2.4 as a project dependency (npm install).
2. Attempt to remediate the underlying picomatch CVE by adding an overrides entry pinning picomatch to a patched version.
3. Run npx next build and containerize the app with the provided Dockerfile.
4. Scan the resulting image with trivy image — the scanner still reports CVE-2026-33671 because node_modules/next/dist/compiled/picomatch/ was never updated by the override.

Impact

Whatever underlying issue picomatch 4.0.3 carries (denial-of-service / ReDoS-class glob-matching flaw) remains present and unpatchable by consumers until Next.js itself ships a release with the vendored copy rebuilt against a fixed picomatch version; it also causes persistent false “unresolved” findings in supply-chain security scanning.

Environment / Lab Setup

Target:   Next.js 16.2.4 project (App Router), Node.js, Docker
Attacker: npm, npx, Docker, Trivy (aquasecurity/trivy) for image scanning

Proof of Concept

PoC Script

See app/, package.json, next.config.mjs, tsconfig.json, and Dockerfile in this folder.

1
2
3
4

npm install
npx next build
docker build -t next-picomatch-repro .
trivy image next-picomatch-repro

Building and scanning the container image shows Trivy flagging picomatch (package.json) | CVE-2026-33671 | HIGH | 4.0.3 | 4.0.4 even after adding a picomatch entry under overrides in package.json, proving the vendored copy under next/dist/compiled/picomatch/ is untouched by that mechanism.

Detection & Indicators of Compromise

picomatch (package.json) | CVE-2026-33671 | HIGH | fixed | 4.0.3 | 4.0.4

Signs of compromise:

• SCA/container scanners continuing to report CVE-2026-33671 against a Next.js image despite an overrides/resolutions fix being present in package.json.
• node_modules/next/dist/compiled/picomatch/package.json showing a stripped/missing version field distinct from the top-level installed picomatch version.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/BeLazy167/next-picomatch-cve-repro on 2026-07-05.