CVE-2026-116795

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-116795
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116795.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-116795
Aliases
Downstream
Published
2026-10-28T17:14:15Z
Modified
2026-10-29T02:48:41Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
RE2JS: Quadratic-time denial of service in re2js lookbehind matching
Details

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1333",
        "CWE-407"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116795.json"
}
References

Affected packages

Git / github.com/le0pard/re2js

Affected ranges

Type
GIT
Repo
https://github.com/le0pard/re2js
Events
Introduced
32727ee7556bc7078564c045e40d84cc18c2f445
Fixed
6ba840014b192668365271d7b1c4d2d24a4b5f83
Fixed
dfdd947785dfa113bdc97416375c246a39458395
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.2.0"
                },
                {
                    "fixed":  "2.8.7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "dfdd947785dfa113bdc97416375c246a39458395"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "2.8.7",
            "range":  [
                {
                    "fixed":  "6ba840014b192668365271d7b1c4d2d24a4b5f83"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.8.0
2.8.2
2.8.3
2.8.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116795.json"