VYPR
Unrated severityNVD Advisory· Published Jul 31, 2026

Debian node-re2: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior …

CVE-2026-68499

Description

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

Affected products

1

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.