diff --git a/ChangeLog b/ChangeLog
index 2318600b9c..630eaf5fc2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Wed May 25 20:50:12 2016  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	* re.c (unescape_nonascii): scan hex up to only 3 characters.
+	  [Bug #12420] [Bug #12423]
+
 Wed May 25 19:07:19 2016  Martin Duerst  <duerst@it.aoyama.ac.jp>
 
 	* enc/unicode.c: Handle DOTLESS_i by hand because it isn't involved in folding.
diff --git a/re.c b/re.c
index 2eb42bc470..84f22b0bc6 100644
--- a/re.c
+++ b/re.c
@@ -2492,8 +2492,8 @@ unescape_nonascii(const char *p, const char *end, rb_encoding *enc,
               case '1': case '2': case '3':
               case '4': case '5': case '6': case '7': /* \O, \OO, \OOO or backref */
                 {
-                    size_t octlen;
-                    if (ruby_scan_oct(p-1, end-(p-1), &octlen) <= 0177) {
+                    size_t len = end-(p-1), octlen;
+                    if (ruby_scan_oct(p-1, len < 3 ? len : 3, &octlen) <= 0177) {
                         /* backref or 7bit octal.
                            no need to unescape anyway.
                            re-escaping may break backref */