Security: ReDoS vulnerability in picomatch (CVE-2026-33671) via chokidar dependency

[GiladShoham]

Description

@rspack/dev-server is affected by CVE-2026-33671 — a Regular Expression Denial of Service (ReDoS) vulnerability in picomatch (CVSS 7.5 HIGH).

Certain extglob patterns (+(), *()) with overlapping alternatives or nested extglobs can trigger excessive backtracking, causing CPU exhaustion and blocking the Node.js event loop.

CVE details: https://nvd.nist.gov/vuln/detail/CVE-2026-33671

Dependency chain

picomatch@2.3.2
└── anymatch@3.1.3
    └── chokidar@3.6.0
        └── @rspack/dev-server@1.2.1

Suggested fix

Update chokidar to v4+, which no longer depends on picomatch/anymatch at all, eliminating this vulnerability entirely.

[chenjiahan]

Upgraded in @rspack/dev-server v2

[chenjiahan]

chokidar v4 includes breaking changes, so it would be difficult for us to upgrade @rspack/dev-server v1.x to chokidar v4 directly.

see https://github.com/paulmillr/chokidar?tab=readme-ov-file#changelog

[GiladShoham]

Thanks @chenjiahan
when is v2 expected?

[chenjiahan]

We plan to release the stable version in April.