Re2Js
Monthly
Quadratic-time denial of service in RE2JS (npm re2js 2.2.0 through 2.8.6) lets attacker-influenced text pin a CPU core when an application compiles a lookbehind pattern with the opt-in RE2JS.LOOKBEHINDS flag and scans it with a repeated-matching API such as matcher().find() in a loop, matchAll(), split(), or matcher().replaceAll(). The engine's advertised linear-time guarantee breaks down because lookbehind automata are re-seeded from offset zero on every match request, so a dense match stream produces Θ(n²) total work - roughly 36-39 seconds of CPU on a single 16,000-character input in the reporter's measurement. No authentication, user interaction, or crafted payload is required: ordinary dense alternating input triggers it, and on Node.js the single-threaded worker is frozen for the duration. No CISA KEV listing is present in the supplied data; a full copy-paste reproduction script is published in the vendor advisory and fix PR, though it is not independently verified as working exploit code here. Fixed in 2.8.7.
Quadratic-time denial of service in RE2JS (npm re2js 2.2.0 through 2.8.6) lets attacker-influenced text pin a CPU core when an application compiles a lookbehind pattern with the opt-in RE2JS.LOOKBEHINDS flag and scans it with a repeated-matching API such as matcher().find() in a loop, matchAll(), split(), or matcher().replaceAll(). The engine's advertised linear-time guarantee breaks down because lookbehind automata are re-seeded from offset zero on every match request, so a dense match stream produces Θ(n²) total work - roughly 36-39 seconds of CPU on a single 16,000-character input in the reporter's measurement. No authentication, user interaction, or crafted payload is required: ordinary dense alternating input triggers it, and on Node.js the single-threaded worker is frozen for the duration. No CISA KEV listing is present in the supplied data; a full copy-paste reproduction script is published in the vendor advisory and fix PR, though it is not independently verified as working exploit code here. Fixed in 2.8.7.