RE2JS: Quadratic-time denial of service in re2js lookbehind matching

Summary Using the opt-in LOOKBEHINDS flag together with any repeated-matching API matcher.find in a loop, matchAll, split, matcher.replaceAll causes quadratic-time Θn² matching, contradicting the library's own "linear time matching" guarantee. A single call with a 16,000-character input takes...

CVE-2026-116795

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher.find, matchAll, split, or matcher.replaceAll can cause quadratic total work. Machine.match restarts...

CVE-2026-116795

The re2js library (a JavaScript port of RE2) versions 2.2.0 through 2.8.7 is vulnerable to a quadratic-time denial of service when LOOKBEHINDS are enabled. The root cause occurs because the Machine.match function restarts lookbehind scanning from offset zero for every requested start position, wh...