ColdFusion Update 26 broke ReReplace: the bug and the hotfix jar

If you applied ColdFusion 2023 Update 26 (or ColdFusion 2025 Update 14) and suddenly saw titles, names, or other cleaned-up strings gain a leading U, you are not imagining it. A long-standing ReReplace case-conversion pattern stopped working, and some sites wrote the bad values straight into production data.

The issue was first reported in the Adobe community as ReReplace broke after Update 26, tracked as CF-4234761. Adobe later posted hotfix jars. Here is what broke, how to confirm it, and how to patch it.

The symptom

A common pattern for title-casing the first letter of a word looks like this:

reReplace(lCase("test"), '^\w|\s\w', '\U\0', 'ALL')

Through Update 25, that returned Test. After Update 26, the same call returns UTest.

ColdFusion is no longer treating \U as “uppercase the following backreference.” The backslash is ignored, so the literal letter U is prepended to the matched character. Related replacement escapes and backreferences have also been reported as broken or changed; see CF-4234762.

That is a quiet failure. The function still returns a string. Nothing throws. Code that capitalizes form input, normalizes names, or rewrites content can keep running and store corrupted values until someone notices.

Who is affected

• ColdFusion 2023 Update 26 (build in the 2023.0.26 line)
• ColdFusion 2025 Update 14 (the matching October 2026 update for 2025)

Any code that uses Perl-style case escapes in the replacement string of ReReplace / REReplaceNoCase — especially \U, \L, \u, \l, and \E with \0 / \1 backreferences — is at risk. Title-case helpers are the most visible example, but they are not the only ones.

Related regex changes in the same update

Update 26 also changed other regex behavior. Two reports that show up alongside this bug:

• Dot-all / multiline matching. Some REMatchNoCase patterns that used to span newlines now need an explicit (?s) flag, for example REMatchNoCase('(?s)\{\{(.*?)\}\}', stringToParse).
• SafeRegex length limits. The update documents JVM flags such as -Dcoldfusion.saferegex.maxpatternlen (default 1000). Patterns longer than that can stop matching and quietly return the original string. Raise the limit only if you understand the ReDoS risk Adobe is trying to contain.

Do not assume the hotfix jar below fixes every regex regression. Test the patterns your application actually uses.

How to patch it

Adobe posted version-specific hotfix jars on the bug tracker attachments (same files appear on CF-4234761 and CF-4234762):

• hf20230005756.jar for ColdFusion 2023
• hf20250005756.jar for ColdFusion 2025

Install steps Adobe and community responders have been using:

1. Download the jar that matches your ColdFusion major version from the tracker attachment list. Sign in to Adobe Tracker if the download requires it.
2. Copy the jar into the instance lib/updates folder, for example:
   C:\ColdFusion2023\cfusion\lib\updates\ on Windows, or
   /opt/ColdFusion2023/cfusion/lib/updates/ on Linux.
   On multi-instance installs, put it under each instance that needs the fix (cfusion, cfusion2, and so on).
3. Restart the ColdFusion service (or every instance you updated).
4. Verify with the one-liner below before you declare production healthy.

Adobe has said this fix is expected to ship in a later cumulative update. Until then, treat the jar as a required companion to Update 26 / Update 14 if you rely on these replacement escapes. Keep a copy of the jar with your change records so a rebuilt server gets the same file.

Verify the fix

Run this in a throwaway page or the Administrator’s CFML sandbox after the restart:

<cfoutput>#reReplace(lCase("test"), '^\w|\s\w', '\U\0', 'ALL')#</cfoutput>

You want Test. If you still see UTest, confirm the jar name matches your major version, that it landed in the correct instance’s lib/updates folder, and that that instance actually restarted.

Then re-run a few real title-case or cleanup paths from your application — not only the toy example. Community testing found the jar restored the original reporter’s case, while some other backreference scenarios still needed more scrutiny. Staging is still required.

If you cannot drop the jar yet

Short-term options while you schedule the hotfix:

• Rewrite the helper without replacement-string case escapes. For a single leading character, something like uCase(left(s, 1)) & mid(s, 2, len(s)) (after lCase if you want) avoids \U entirely.
• Roll back to Update 25 only if security and ops accept that trade-off. Rolling back a ColdFusion core update is messier than a snapshot restore; prefer restoring a pre-update snapshot when you can.
• Stop the write path that persists the corrupted strings until the jar is in place, if the damage is still ongoing.

ChatGPT-style “fixed” patterns that still use \U\1 have been reported to make results worse on the broken builds. Do not treat an alternate escape spelling as a substitute for the hotfix.

Cleaning up bad data

If values were saved after the update, you may have rows that start with a literal U that should not be there — UTest instead of Test, USmith instead of Smith, and so on. There is no universal SQL fix: only you know which columns used that helper and which legitimate values start with U.

A practical approach:

1. Identify every code path that used \U / \L style replacements into persistent storage.
2. Query for suspicious values created after the update was applied.
3. Spot-check before bulk updates. Prefer restoring from a known-good backup for those columns when the corruption window is clear.

Need a hand?

We apply ColdFusion updates for clients through application server maintenance, and we dig into breakage like this through ColdFusion & Lucee troubleshooting. If Update 26 left you with bad title-case data, a regex regression you cannot pin down, or a jar you want installed cleanly across instances, get in touch with Tierney Dynamics.

Primary sources for this post: the Adobe community report, tracker items CF-4234761 / CF-4234762, Adobe’s ColdFusion 2023 Update 26 notes, and Charlie Arehart’s October 13, 2026 update roundup.