belazy167/next-picomatch-cve-reproMinimal repro for Next.js 16.2.4 bundling picomatch 4.0.3 (CVE-2026-33671)
Minimal reproduction for: Next.js 16.2.4 ships with picomatch 4.0.3 vendored at node_modules/next/dist/compiled/picomatch/, which is affected by CVE-2026-33671 (HIGH). npm overrides cannot reach the bundled copy.
npm install
cat node_modules/next/dist/compiled/picomatch/package.json
# → {"name":"picomatch","main":"index.js",...} (version field stripped)
npx next build
docker build -t next-picomatch-repro .
trivy image next-picomatch-repro
Expected output:
picomatch (package.json) | CVE-2026-33671 | HIGH | fixed | 4.0.3 | 4.0.4
overrides does not helppackage.json can be extended with:
"overrides": {
"picomatch": "4.0.4"
}
This correctly installs node_modules/[email protected], but node_modules/next/dist/compiled/picomatch/ stays on 4.0.3 because it is bundled inside Next's own tarball.
Next.js publishes a patch release with dist/compiled/picomatch/ re-bundled from picomatch ≥ 4.0.4. Downstream consumers then pick it up via normal npm install.