CVE-2026-119300

The record

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.

Affected packages

Related vulnerabilities

• CVE-2026-62864 Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. CWE-1333
• CVE-2026-118993 CallBackery versions before 0.62.0 for Perl allow denial of service via the request path… CWE-1333
• CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular… CWE-1333
• CVE-2026-119202 @hapi/content provides HTTP Content-* header parsing. CWE-1333
• CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-1333
• CVE-2026-118772 joi is a schema description language and data validator for JavaScript. CWE-1333
• CVE-2026-118686 EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability… CWE-1333
• CVE-2026-118646 n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service… CWE-1333