CVE-2026-68499CWE-835

CVE-2026-68499

Medium · published July 31, 2026

CVSS v3.1
6.2
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00184 · 7.5th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-07-31T01:18Z
References (4)
https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d · [email protected]https://github.com/uhop/node-re2/releases/tag/1.25.2 · [email protected]https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836 · [email protected]https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 JUL 20:07Z
    re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
    cvelistv5