CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d
https://github.com/uhop/node-re2/releases/tag/1.25.2
https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836
https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) re2 proporciona enlaces para Node.js para el motor de expresiones regulares RE2 de Google. Antes de la versión 1.25.2, la implementación de String.prototype.match de re2 con un patrón RE2 global que puede coincidir con la cadena vacía no logra avanzar su cursor de coincidencia nativo en lib/match.cc, causando un bucle infinito y un crecimiento ilimitado de la memoria nativa que bloquea el bucle de eventos y puede agotar la memoria del host. Este problema está solucionado en la versión 1.25.2.

Information

Published : 2026-07-30 21:18

Updated : 2026-10-23 22:10

NVD link : CVE-2026-68499

Mitre link : CVE-2026-68499

CVE.ORG link : CVE-2026-68499

JSON object : View

Products Affected

No product.

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2026-68499", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68499", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T19:18:39.668208Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "uhop", "product": "node-re2", "versions": [{"status": "affected", "version": "< 1.25.2"}]}]}], "published": "2026-07-30T21:18:12.870", "references": [{"url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d", "source": "security-advisories@github.com"}, {"url": "https://github.com/uhop/node-re2/releases/tag/1.25.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836", "source": "security-advisories@github.com"}, {"url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2."}, {"lang": "es", "value": "re2 proporciona enlaces para Node.js para el motor de expresiones regulares RE2 de Google. Antes de la versi\u00f3n 1.25.2, la implementaci\u00f3n de String.prototype.match de re2 con un patr\u00f3n RE2 global que puede coincidir con la cadena vac\u00eda no logra avanzar su cursor de coincidencia nativo en lib/match.cc, causando un bucle infinito y un crecimiento ilimitado de la memoria nativa que bloquea el bucle de eventos y puede agotar la memoria del host. Este problema est\u00e1 solucionado en la versi\u00f3n 1.25.2."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security-advisories@github.com"}