# CVE-2026-77421: JLine Nano editor ReDoS in regex search mode

Source: https://junglewise.ai/threats/cve-2026-77421-jline-nano-editor-redos-in-regex-search-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77421 · Severity: medium · CVSS 6.5 · Published 2026-09-23

JLine is a Java library that provides terminal editing capabilities, including a built-in nano editor for interactive text editing. When regex search mode is enabled in the nano editor, an attacker can supply a specially crafted regular expression pattern that causes the editor to hang and consume high CPU, denying service to the user or (in multi-user deployments) monopolizing a server worker thread.

Technologies: [JLine](https://junglewise.ai/threats/technologies/jline). Vendors: [JLine](https://junglewise.ai/threats/vendors/jline), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-77421 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77421 being exploited in the wild.

**How severe is CVE-2026-77421?** Medium severity, with a CVSS score of 6.5, published 23 September 2026.

**Which products and versions are affected?** JLine <UNKNOWN>; org.jline:jline-builtins (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.3.1.

**Is there a fix for CVE-2026-77421?** Yes. org.jline:jline-builtins (Maven): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77421 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-77421?** Check whether you run JLine or org.jline:jline-builtins (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jline:jline-builtins (Maven): upgrade to 4.3.1 or later

  ```sh
  # set org.jline:jline-builtins to 4.3.1 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is a regular expression denial-of-service (ReDoS) flaw in the Nano.java search implementation. When regex mode is enabled, user-supplied search terms are compiled directly as Java regular expressions without timeout or backtracking bounds. The vulnerable code path uses Java's standard backtracking-based regex engine, which is susceptible to catastrophic backtracking on nested-quantifier patterns such as (a+)+b. An attacker must enable regex search mode in the editor and supply the malicious pattern; the pattern is then compiled and applied against buffer content. The suggested fix is to replace the Java regex engine with Google's RE2J linear-time engine, or as a fallback, to enforce regex compilation timeouts or reject dangerous constructs.

## Affected products

- JLine JLine <UNKNOWN>

## Identifiers

- CVE-2026-77421
- GHSA-ph9c-7hw9-vhhw

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: advisory: CVE-2026-77421

## Related threats

- [JLine regular expression denial of service in less viewer](https://junglewise.ai/threats/cve-2026-77423-jline-is-a-java-library-for-handling-console-input-from-3-0-0)
- [JLine ReDoS in built-in grep command](https://junglewise.ai/threats/cve-2026-77422-jline-redos-in-built-in-grep-command)
- [JLine HISTORY_IGNORE ReDoS via unescaped regex metacharacters](https://junglewise.ai/threats/cve-2026-77420-jline-history-ignore-redos-via-unescaped-regex-metacharacters)
- [JLine JLine3 denial of service in Telnet server NAWS handling](https://junglewise.ai/threats/cve-2026-56741-jline-jline3-denial-of-service-in-telnet-server-naws-handling)
- [JLine JLine3 denial of service in Telnet server NEW-ENVIRON handling](https://junglewise.ai/threats/cve-2026-56740-jline-jline3-denial-of-service-in-telnet-server-new-environ)