CVE-2026-116795

The re2js library (a JavaScript port of RE2) versions 2.2.0 through 2.8.7 is vulnerable to a quadratic-time denial of service when LOOKBEHINDS are enabled. The root cause occurs because the Machine.match function restarts lookbehind scanning from offset zero for every requested start position, wh...