What’s Vulnerable › Vulnerabilities

CVE-2026-68499: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

• Severity: medium (CVSS 6.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-30 · updated 2026-10-23
• Weakness: CWE-835

Description

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

Affected products

• uhop node-re2: before 1.25.2

References

• https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d
• https://github.com/uhop/node-re2/releases/tag/1.25.2
• https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836
• https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836

Get alerted when CVE-2026-68499 or the next vulnerability affects your stack