Zero Radar
← feed
HighVulnerabilityCVE-2026-116795updated 28 Oct 2026, 21:10 UTC

re2js regex library can freeze Node.js on crafted text with lookbehinds

A text-matching library can be made to spend a very long time on a single input, which can freeze the server process while it works. An attacker only needs to send a moderately large text.

Fixed in 2.8.7Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?Yes2.8.7 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends textCrafted input of alternating characters, ~16 KB
  2. 2App runs re2js matchLookbehind pattern with find, split or replaceAll
  3. 3Matcher rescans inputRestarts from offset zero on every match
  4. 4CPU pinnedQuadratic work blocks the single-threaded worker
  5. ResultServer worker freezes, service denied

What happened

In re2js, using the opt-in LOOKBEHINDS flag with repeated matching (find loops, matchAll, split, replaceAll) causes quadratic-time matching (Θ(n²)) instead of the advertised linear time, because the scan restarts from offset zero on every match.

Why it is dangerous: A ~16 KB input can tie up the single-threaded Node.js worker for tens of seconds, denying service to other users. Services that run lookbehind-based patterns on user-supplied text such as logs, uploads, or scraped content are at risk.

Are you affected?

You are affected if you use re2js versions 2.2.0 up to but not including 2.8.7 with the LOOKBEHINDS flag and repeated matching APIs on attacker-influenced text.

Package / productAffected versionsFixed in
re2js · npm>= 2.2.0, < 2.8.72.8.7

What to do

  1. Update re2js to version 2.8.7 or later
  2. If you cannot update yet, avoid enabling LOOKBEHINDS on untrusted input
  3. Limit the length of user-supplied text passed to regex matching

Timeline

  1. 28 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 18:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 21:10 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 21:10 UTC
    Fixed version published: re2js 2.8.7 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116795 · GHSA-gg6h-894w-4m9c
CVSS
7.5 / 10
Disclosed
28 Oct 2026, 18:17 UTC
On Zero Radar
28 Oct 2026, 18:17 UTC (1 min after disclosure)
Last change
28 Oct 2026, 21:10 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

re2js regex library can freeze Node.js on crafted text with lookbehinds · Zero Radar