EUVD-2026-112268
GHSA-gg6h-894w-4m9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit dense alternating text to endpoint
-
DeliveryProcessed by lookbehind pattern via matchAll/replaceAll
-
ExploitLookbehind rescans whole input per match (Θ(n²))
-
ExecutionCPU core pinned, single-threaded worker frozen
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Exploitation requires that the application compile patterns with the opt-in RE2JS.LOOKBEHINDS flag AND use a lookbehind-containing pattern through a repeated-matching API - matcher().find() in a loop, matchAll(), split(), or matcher().replaceAll() - against attacker-controlled text. No authentication, user interaction, special pattern knowledge, or crafted payload is needed from the attacker: ordinary dense alternating input (e.g. 'abababab…') triggers the quadratic behavior, and impact scales with input size (~16-32 KB pins a core for tens of seconds). Limiting factors: deployments that do not enable LOOKBEHINDS or do not apply lookbehind patterns to untrusted input are unaffected; a single captureless find() with ncap===0 would early-exit, but the Matcher-based APIs always request ncap=2, which is why those specific repeated-matching paths are vulnerable. Impact is amplified on Node.js because its single-threaded model freezes the whole worker for the duration. |
| Impact | All signals point to a genuine but bounded availability risk, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, unauthenticated, no-interaction, availability-only flaw - there is no confidentiality or integrity impact (so the 'Information Disclosure' tag contradicts the vector and is incorrect; this is a CWE-407/CWE-1333 algorithmic-complexity DoS). The real-world risk is gated by a precondition the CVSS score cannot express: the consuming application must have opted into the LOOKBEHINDS flag and use a lookbehind pattern through a repeated-matching API on attacker-influenced input. A public, copy-paste-runnable proof-of-concept is published inside the GHSA advisory with deterministic timing results (36.7-38.7s CPU for a 16,000-char input), so weaponization effort is trivial where the precondition holds. KEV status is NO (not CISA-listed) and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - consistent with the vuln.today 'this_week' decision label rather than an emergency. Net: a real, easily-reproducible DoS for the subset of deployments using opt-in lookbehinds, but the opt-in gate keeps the population affected well below the raw 7.5 'network/unauthenticated' reading. |
| Exploit ScenarioDerived | A service uses re2js with the opt-in LOOKBEHINDS flag to tokenize or redact attacker-influenced text (user input, uploaded logs, scraped content) via matchAll(), split(), replaceAll(), or a find() loop. An attacker submits ordinary dense alternating text such as 'abababab…' of ~16-32 KB; because the lookbehind automaton rescans from offset 0 on every match and the Matcher APIs request a capture slot that defeats the early-exit, total work becomes quadratic, pinning a CPU core for tens of seconds and freezing the single-threaded Node.js worker. A public PoC demonstrating this is published in the GHSA advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Quadratic-time denial of service in RE2JS (npm re2js 2.2.0 through 2.8.6) lets attacker-influenced text pin a CPU core when an application compiles a lookbehind pattern with the opt-in RE2JS.LOOKBEHINDS flag and scans it with a repeated-matching API such as matcher().find() in a loop, matchAll(), split(), or matcher().replaceAll(). The engine's advertised linear-time guarantee breaks down because lookbehind automata are re-seeded from offset zero on every match request, so a dense match stream produces Θ(n²) total work - roughly 36-39 seconds of CPU on a single 16,000-character input in the reporter's measurement. No authentication, user interaction, or crafted payload is required: ordinary dense alternating input triggers it, and on Node.js the single-threaded worker is frozen for the duration. No CISA KEV listing is present in the supplied data; a full copy-paste reproduction script is published in the vendor advisory and fix PR, though it is not independently verified as working exploit code here. Fixed in 2.8.7.
RemediationAI
Upgrade the npm re2js dependency to 2.8.7 or later, the version that carries the LookbehindState fix (release notes at https://github.com/le0pard/re2js/releases/tag/2.8.7, patch PR at https://github.com/le0pard/re2js/pull/59, commit dfdd947785dfa113bdc97416375c246a39458395, advisory https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c); note that 2.2.0-2.8.6 are all listed as vulnerable, so any earlier pin also needs to move. Where the upgrade cannot be applied immediately, the practical compensating control is to stop compiling untrusted-input patterns with the RE2JS.LOOKBEHINDS flag - without that opt-in the quadratic behavior is not reachable, at the cost of losing lookbehind support entirely. Alternatively, avoid routing untrusted text through repeated-matching APIs (matcher().find() loops, matchAll(), split(), matcher().replaceAll()) when the pattern contains a lookbehind, for example by pre-truncating or size-capping input before the regex pass and rejecting oversized payloads; this bounds but does not eliminate the per-call rescans and may break legitimate large-input processing. Because the stall is synchronous CPU work, isolating regex execution in a worker thread with a hard timeout contains the freeze of the main event loop but consumes additional CPU and requires an async execution redesign. There is no vendor-released patch for versions below 2.8.7; the fixed release is the complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RE2JS is a JavaScript port of RE2 that implements a Pike/Thompson-style NFA simulation (a run queue of instruction pointers) rather than a backtracking matcher, precisely to keep matching linear in input length. Lookbehind support is compiled by prefixing each lookbehind sub-automaton with .*? so it can observe every character preceding the search position, and the main pattern's matching runs in lockstep with those lookbehind automata. In the vulnerable build (build/index.cjs, Machine.match), any program containing a lookbehind sets prog.numLb > 0, which forces the scan to restart at offset 0 regardless of the caller's requested start position; the early-exit optimization if (this.ncap === 0 && this.matched) break therefore only fires for captureless single-shot matching, while every Matcher-based API (find/matchAll/split/replaceAll) requests ncap = 2 even for a captureless lookbehind pattern, so the scan runs to end-of-input on each find(). A find-loop over k matches in an n-character string costs k × Θ(n), and for dense matches k ∝ n, yielding Θ(n²). Root cause is classified CWE-407 (inefficient algorithmic complexity), with the advisory also tagging CWE-1333 (inefficient regular expression complexity). The upstream fix introduces a LookbehindState object that carries live lookbehind threads and the lookbehind table between successive searches over the same input, resuming from the saved position instead of restarting at zero, plus a Queue.mainThreads counter so lookbehind automata no longer keep a search alive on their own; the README notes that only a backwards find(start) jump now re-evaluates lookbehinds from the beginning of the input. The trigger requires the application to enable LOOKBEHINDS and apply a lookbehind pattern to untrusted text; the exact mechanism by which an attacker reaches such a code path depends on the consuming application and is not described in the available sources.
Know when Re2Js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attacker only supplies ordinary alternating text remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); availability-only DoS (A:H, C/I:N); the LOOKBEHINDS opt-in is an app-config precondition, not an attacker privilege.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.
Technical POC Analysis
CWE-407 (Inefficient Algorithmic Complexity), additionally tagged CWE-1333.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity denial-of-service vulnerability in the RE2JS regular expression library (npm package re2js versions 2.2.0 through 2.8.6) can allow attacker-controlled input to consume excessive CPU, potentially freezing Node.js services. Applications that use the opt-in lookbehind feature and repeated-matching APIs are at risk, which could lead to service outages or degraded performance for end users. Leadership should prioritize remediation because exploitation requires no authentication and can be triggered by ordinary text input.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling the RE2JS.LOOKBEHINDS flag, avoiding repeated-matching APIs on untrusted input, enforcing input length restrictions, and implementing rate limiting or request timeouts.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB