VULNERABILITY INTELLIGENCE

CVE-2026-68499

CVSS score6.2 MEDIUM
EPSS probability0.18%
CISA KEVNot currently listed
Published2026-07-30
Last modified2026-10-23
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

Weakness classification

  • security-advisories@github.com: CWE-835

Primary references