RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From
    2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(),
    split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind
    scanning from offset zero for each requested start position, while Matcher-based APIs request capture
    slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan
    the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This
    issue is fixed in version 2.8.7. (CVE-2026-116795)

ID	Name	Product	Family	Type	Severity
478019	Chainguard: kibana-9.5: security update to 9.5.5-r7	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
478019	Chainguard: kibana-9.5: security update to 9.5.5-r7	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
477803	SCA: security update for re2js (GHSA-gg6h-894w-4m9c)	Tenable Cloud Security	SCA Checks	Local	high
477803	SCA: security update for re2js (GHSA-gg6h-894w-4m9c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-116795

high

Tenable Plugins

high

high

high

high