CVE-2026-116795

    Dashboard / Vulnerabilities / CVE-2026-116795

    CVE-2026-116795

    Published: 28 Oct 2026Last Modified: 4 Nov 2026

    Summary: RE2JS: Quadratic-time denial of service in re2js lookbehind matching

    Details: RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.

    References: https://github.com/le0pard/re2js/releases/tag/2.8.7, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116795.json, https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c, https://nvd.nist.gov/vuln/detail/CVE-2026-116795, https://github.com/le0pard/re2js/commit/dfdd947785dfa113bdc97416375c246a39458395, https://github.com/le0pard/re2js/pull/59

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 32727ee7556bc7078564c045e40d84cc18c2f445
    Fixed -6ba840014b192668365271d7b1c4d2d24a4b5f83

    Affected versions

    2.8.6
    2.8.3
    2.8.2
    2.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-116795 | CVE-DB