npm: RE2JS: Quadratic-time denial of service in re2js lookbehind matching

npm: RE2JS: Quadratic-time denial of service in re2js lookbehind matching vulnerability discovered by ? in WordPress npm re2js versions = 2.2.0, 2.8.7...

CVE-2026-116795

The re2js library (a JavaScript port of RE2) versions 2.2.0 through 2.8.7 is vulnerable to a quadratic-time denial of service when LOOKBEHINDS are enabled. The root cause occurs because the Machine.match function restarts lookbehind scanning from offset zero for every requested start position, wh...

CVE-2026-116795 RE2JS: Quadratic-time denial of service in re2js lookbehind matching

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher.find, matchAll, split, or matcher.replaceAll can cause quadratic total work. Machine.match restarts...