CVE-2026-116795: RE2JS: Quadratic-time denial of service in re2js lookbehind matching
RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RE2JSto a version that resolves this vulnerability.Fixed in 2.8.7
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service condition?
Applications using re2js versions 2.2.0 through 2.8.7 are exposed when LOOKBEHINDS is enabled and they perform repeated matching with matcher().find(), matchAll(), split(), or matcher().replaceAll(). The impact is most relevant when an attacker can influence dense-match input processed by a single-threaded worker.
Does an attacker need authentication or user interaction to trigger the issue?
No. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction, provided the application exposes a path that processes attacker-influenced text with the affected configuration and APIs.
What is the recommended remediation?
Update re2js to version 2.8.7, which fixes the issue. If upgrading cannot happen immediately, avoid enabling LOOKBEHINDS for workloads that use the affected repeated-matching APIs on attacker-influenced input.
How can I determine whether a code path is affected?
Check whether the application uses re2js 2.2.0 through 2.8.7, enables LOOKBEHINDS, and invokes matcher().find(), matchAll(), split(), or matcher().replaceAll(). Affected paths repeatedly scan input and may exhibit excessive CPU use when given dense-match attacker-controlled text.