CVE-2026-116795

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116795", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-26T21:53:35.168Z", "datePublished": "2026-10-28T17:14:15.988Z", "dateUpdated": "2026-11-02T20:21:58.052Z"}, "containers": {"cna": {"title": "RE2JS: Quadratic-time denial of service in re2js lookbehind matching", "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c"}, {"name": "https://github.com/le0pard/re2js/pull/59", "tags": ["x_refsource_MISC"], "url": "https://github.com/le0pard/re2js/pull/59"}, {"name": "https://github.com/le0pard/re2js/commit/dfdd947785dfa113bdc97416375c246a39458395", "tags": ["x_refsource_MISC"], "url": "https://github.com/le0pard/re2js/commit/dfdd947785dfa113bdc97416375c246a39458395"}, {"name": "https://github.com/le0pard/re2js/releases/tag/2.8.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/le0pard/re2js/releases/tag/2.8.7"}], "affected": [{"vendor": "le0pard", "product": "re2js", "versions": [{"version": ">= 2.2.0, < 2.8.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T17:14:15.988Z"}, "descriptions": [{"lang": "en", "value": "RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7."}], "source": {"advisory": "GHSA-gg6h-894w-4m9c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T20:21:37.507465Z", "id": "CVE-2026-116795", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T20:21:58.052Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116795", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T20:21:37.507465Z"}}}], "references": [{"url": "https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T20:21:53.348Z"}}], "cna": {"title": "RE2JS: Quadratic-time denial of service in re2js lookbehind matching", "source": {"advisory": "GHSA-gg6h-894w-4m9c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "le0pard", "product": "re2js", "versions": [{"status": "affected", "version": ">= 2.2.0, < 2.8.7"}]}], "references": [{"url": "https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c", "name": "https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/le0pard/re2js/pull/59", "name": "https://github.com/le0pard/re2js/pull/59", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/le0pard/re2js/commit/dfdd947785dfa113bdc97416375c246a39458395", "name": "https://github.com/le0pard/re2js/commit/dfdd947785dfa113bdc97416375c246a39458395", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/le0pard/re2js/releases/tag/2.8.7", "name": "https://github.com/le0pard/re2js/releases/tag/2.8.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T17:14:15.988Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116795", "state": "PUBLISHED", "dateUpdated": "2026-11-02T20:21:58.052Z", "dateReserved": "2026-10-26T21:53:35.168Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T17:14:15.988Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "re2js", "vendor": "le0pard", "versions": [{"status": "affected", "version": ">= 2.2.0, < 2.8.7"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7."}], "id": "CVE-2026-116795", "lastModified": "2026-11-02T21:17:25.320", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116795", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T20:21:37.507465Z", "version": "2.0.3"}}]}, "published": "2026-10-28T18:17:14.303", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/le0pard/re2js/commit/dfdd947785dfa113bdc97416375c246a39458395"}, {"source": "security-advisories@github.com", "url": "https://github.com/le0pard/re2js/pull/59"}, {"source": "security-advisories@github.com", "url": "https://github.com/le0pard/re2js/releases/tag/2.8.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}, {"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds", "id": "2563031", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563031"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.", "A flaw was found in re2js. When lookbehind assertions are enabled, repeated regular expression matching can cause the engine to repeatedly rescan input text from the beginning, leading to quadratic processing time. A remote attacker could supply crafted input to monopolize worker thread resources, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-116795", "public_date": "2026-10-28T17:14:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116795\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116795\nhttps://github.com/le0pard/re2js/commit/dfdd947785dfa113bdc97416375c246a39458395\nhttps://github.com/le0pard/re2js/pull/59\nhttps://github.com/le0pard/re2js/releases/tag/2.8.7\nhttps://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c"], "statement": "This vulnerability is rated as Important because unauthenticated remote actors can cause algorithmic complexity exhaustion without specialized privileges, potentially blocking single-threaded Node.js event loops and denying service across dependent workloads. The issue specifically requires services to explicitly enable the optional lookbehind parsing feature when evaluating repeated patterns against user-controlled content. Applications that process untrusted data using standard regular expression options without lookbehind assertions are not susceptible to this denial of service.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,2.8.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "re2js", "source": "cna", "vendor": "le0pard"}, "product": "re2js", "vendor": "le0pard"}], "created": "2026-10-28T18:45:07.234018+00:00", "updated": "2026-10-28T21:45:34.075323+00:00", "vendors": ["le0pard", "le0pard$PRODUCT$re2js"]}