RE2JS: Quadratic-time denial of service in re2js lookbehind matching

影響: npm:re2js >= 2.2.0, < 2.8.7 → 2.8.7

Using the opt-in LOOKBEHINDS flag together with any repeated-matching API (matcher().find() in a loop, matchAll(), split(), matcher().replaceAll()) causes quadratic-time (Θ(n²)) matching, contradicting the library's own "linear time matching" guarantee. A single call with a 16,000-character input takes 36.7–38.7 seconds of CPU. Description Root cause In build/index.cjs, Machine.match: js let currentPos = this.prog.numLb > 0 ? 0 : pos; // ~line 1907 ... if (this.ncap === 0 && this.matched) break…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:10, GitHub Advisory Database에서 "RE2JS: Quadratic-time denial of service in re2js lookbehind matching"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-116795.