Read the docs
TI-2026-82123 Aliases CVE-2026-116795GHSA-gg6h-894w-4m9c

Quadratic-time denial of service in RE2JS lookbehind matching

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

The re2js npm package from 2.2.0 before 2.8.7 is affected. With LOOKBEHINDS enabled, repeated matching through matcher().find(), matchAll(), split() or matcher().replaceAll() can cause quadratic total work, because lookbehind scanning restarts from offset zero for each start position (CWE-407). A remote, unauthenticated attacker who influences the input text can monopolize a single-threaded worker and deny service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Fixed re2js (le0pard): 2.8.7re2js (npm): 2.8.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
le0pardre2js2.2.0 to before 2.8.72.8.7Patch availableCNA
—re2js (npm)2.2.0 to before 2.8.72.8.7Patch availableGHSA-gg6h-894w-4m9c
  • re2js Vendorle0pard Affected 2.2.0 to before 2.8.7 Fixed in 2.8.7 Patch available CNA
  • re2js (npm) Vendor— Affected 2.2.0 to before 2.8.7 Fixed in 2.8.7 Patch available GHSA-gg6h-894w-4m9c

Remediation

Upgrade the re2js npm package to version 2.8.7 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA re2js (le0pard) Fixed in 2.8.7
  • Fix · GHSA-gg6h-894w-4m9c re2js (npm) Fixed in 2.8.7 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-116795
  2. 2026-10-28 Alias added: GHSA-gg6h-894w-4m9c
  3. 2026-10-28 Fix available: npm/[email protected] · GHSA-gg6h-894w-4m9c
  4. 2026-10-28 CVSS score added · GHSA-gg6h-894w-4m9c
  5. 2026-10-28 Weakness changed · GHSA-gg6h-894w-4m9c
  6. 2026-10-28 6 new references · GHSA-gg6h-894w-4m9c
  7. 2026-10-29 Affected versions changed · Red Hat
  8. 2026-10-29 CVSS score added · Red Hat
  9. 2026-10-30 Priority changed: MEDIUM → LOW
  10. 2026-11-02 CISA SSVC decision points changed
  11. 2026-11-02 Priority changed: LOW → HIGH

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences