Cloudanix VulnDB

CVE-2026-116795

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a text-matching library lets attackers send specially crafted patterns that can slow an application to a crawl or make it unresponsive.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Enabling lookbehinds combined with repeated Matcher-based matching APIs (find, matchAll, split, replaceAll) causes quadratic rescanning of input because Machine.match restarts lookbehind scans from offset zero and capture slots block early exits.

Why it matters to the business

Single-threaded workers processing attacker-controlled text can be monopolized, leading to service degradation or outage in applications that rely on RE2JS for validation or parsing.

How an attack unfolds

An attacker supplies input containing dense match opportunities that exercise lookbehinds, then repeatedly invokes one of the affected Matcher APIs; each call rescans the entire input, accumulating quadratic CPU usage until the worker is exhausted.

How to fix it

Upgrade RE2JS to version 2.8.7 or later; disable lookbehinds if the feature is not required; add input-size and execution-time limits around regex operations as defense-in-depth.

How to confirm the fix worked

Confirm the installed version is 2.8.7 or newer; run the library's test suite with lookbehinds enabled and verify that execution time remains linear on crafted dense-match inputs; monitor worker CPU during synthetic load tests.

Typical attack path

  1. Identify an application endpoint that uses RE2JS with lookbehinds enabled.
  2. Craft input strings designed to trigger repeated lookbehind rescans on match APIs.
  3. Submit the input in rapid succession or in a loop via the exposed API.
  4. Observe sustained high CPU on the target worker thread leading to denial of service.

How to detect it

Review application logs for unusually long regex execution times or high CPU on threads handling text validation; correlate spikes with incoming requests containing complex lookbehind patterns; inspect dependency manifests for vulnerable RE2JS versions.

What your security team should do

  • Prioritize upgrade to 2.8.7 within the next sprint for any service using RE2JS lookbehinds.
  • Inventory all packages depending on RE2JS and enforce version pinning in build pipelines.
  • Implement request timeouts and CPU quotas on regex-processing workers.
  • Add runtime metrics for regex execution duration to detect anomalous patterns.

The record

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities