le0pard re2js vulnerabilities

Latest le0pard re2js CVEs

Newest publication first

1. CVE-2026-116795 RE2JS: Quadratic-time denial of service in re2js lookbehind matching

   Published 2026-10-28

   High·CVSS 7.5 EPSS 0.46%

   RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. M...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.