CVE-2026-68499

MediumCVSS 6.2

Published: 30/07/2026(UTC)Updated: 23/10/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The re2 library for Node.js prior to version 1.25.2 contains a vulnerability in the String.prototype.match implementation with a global RE2 pattern that can match the empty string. The function fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory.

Risk Assessment

The organization risks a Denial of Service (DoS) attack on Node.js applications using re2, potentially causing service unavailability and data loss.

Recommendation

Update the re2 library to version 1.25.2 or later, which includes a fix preventing the infinite loop.

Other vulnerabilities in re2

CVE-2026-67550Medium
The re2 library for Node.js prior to version 1.25.2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split. This allows an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases.

Original NVD description (English source)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS