CWE-133336 advisories

Inefficient Regular Expression Complexity (ReDoS)

What it is

A regex with catastrophic backtracking hangs the process on a crafted input, causing denial of service.

How to fix it

Upgrade to a version with a linear-time regex or input caps.

How to avoid it

Avoid nested quantifiers; bound input length and use a linear-time regex engine where possible.

Known Inefficient Regular Expression Complexity (ReDoS) vulnerabilities

CVE-2026-86081 — high · npm/n8n
GHSA-j95f-988m-3j2f — high · npm/@tiptap/core
CVE-2026-83619 — high · npm/@xmldom/xmldom
CVE-2026-85062 — medium · npm/colord
CVE-2026-83606 — high · npm/@xmldom/xmldom
CVE-2026-81725 — medium · PyPI/nltk
CVE-2026-80206 — high · PyPI/nltk
CVE-2026-80205 — high · PyPI/nltk
CVE-2026-73556 — medium · PyPI/vllm
GHSA-j8pm-gj4c-rq4x — high · Packagist/league/commonmark
GHSA-vf76-f5cp-9846 — high · PyPI/nltk
CVE-2026-55520 — high · PyPI/Protego
CVE-2026-57584 — high · Packagist/phalcon/cphalcon
CVE-2026-59893 — high · PyPI/sqlparse
CVE-2026-54284 — high · PyPI/sqlparse
CVE-2026-67422 — high · PyPI/pymdown-extensions
CVE-2026-66062 — medium · npm/@sveltejs/kit
CVE-2026-70493 — medium · PyPI/open-webui
CVE-2026-70489 — medium · PyPI/open-webui
CVE-2026-69207 — medium · npm/hono
CVE-2026-53500 — high · PyPI/thumbor
CVE-2026-12061 — high · PyPI/nltk
CVE-2026-59220 — medium · PyPI/open-webui
CVE-2026-58436 — high · Go/code.gitea.io/gitea
CVE-2026-59922 — high · PyPI/mistune
CVE-2026-59925 — high · PyPI/mistune
CVE-2026-59928 — high · PyPI/mistune
CVE-2026-55574 — high · PyPI/vllm
CVE-2026-49851 — high · PyPI/mistune
CVE-2026-52778 — critical · Packagist/yeswiki/yeswiki
CVE-2026-49485 — high · Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2
CVE-2026-49477 — high · PyPI/soupsieve
GHSA-x4hg-hfwf-p9mw — medium · npm/@asymmetric-effort/nogginlessdom
CVE-2026-52746 — high · npm/jsonata
CVE-2026-49293 — high · npm/js-toml
CVE-2026-48801 — high · npm/linkify-it

Stateward flags Inefficient Regular Expression Complexity (ReDoS) in your own code and dependencies on every pull request.

Scan my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.