CVE-2026-116795
Description
A flaw was found in re2js. When lookbehind assertions are enabled, repeated regular expression matching can cause the engine to repeatedly rescan input text from the beginning, leading to quadratic processing time. A remote attacker could supply crafted input to monopolize worker thread resources, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Important because unauthenticated remote actors can cause algorithmic complexity exhaustion without specialized privileges, potentially blocking single-threaded Node.js event loops and denying service across dependent workloads. The issue specifically requires services to explicitly enable the optional lookbehind parsing feature when evaluating repeated patterns against user-controlled content. Applications that process untrusted data using standard regular expression options without lookbehind assertions are not susceptible to this denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
