CVE-2026-116795

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher.find, matchAll, split, or matcher.replaceAll can cause quadratic total work. Machine.match restarts...

CVE-2026-116795

The re2js library (a JavaScript port of RE2) versions 2.2.0 through 2.8.7 is vulnerable to a quadratic-time denial of service when LOOKBEHINDS are enabled. The root cause occurs because the Machine.match function restarts lookbehind scanning from offset zero for every requested start position, wh...