RE2JS: Quadratic-time denial of service in re2js lookbehind matching
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.8.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The RE2JS library, a JavaScript port of Google's RE2 regular expression engine, is affected when lookbehind patterns are used with repeated matching methods such as find(), matchAll(), split(), or replaceAll(). An attacker who can influence the input text can make matching take far longer than expected, potentially tying up a single-threaded process and denying service to other users.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- le0pard re2js
From 2.2.0 · fixed in 2.8.7
- re2jsnpm
From 2.2.0 · fixed in 2.8.7