Live › vulnerability › CVE-2026-116795
Go to dashboardRE2JS, the JavaScript port of Google's RE2 regex engine, rescans input from the start for each match when lookbehinds are enabled and matcher-based APIs are used. Attacker-controlled text with many dense matches can tie up a single-threaded worker and deny service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Applications that use RE2JS with lookbehinds enabled and call matcher-based APIs (find, matchAll, split, replaceAll) on attacker-influenced text. Applications using RE2JS with default settings or without lookbehinds, or only on trusted input, are less exposed.
No product ranges from the sources yet.
npm ls re2jsLOOKBEHINDS or matcher().find(), matchAll(), split(), replaceAll() used with RE2JS on untrusted input2.8.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-116795")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.