p PatchFirst

CVE-2026-68499

CVE-2026-68499 · re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

CVSS 6.2 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node-re2

    Versions
    • < 1.25.2: Affected

    No fix published

  • node-re2 Debian:12

    Versions
    • 1.18.0+~cs2.13.8-1
    • 1.19.2+~cs2.13.13-1
    • 1.20.10+~cs2.13.13-1
    • 1.20.12+~cs2.13.13-1
    • 1.21.4+~cs2.13.13-1
    • 1.21.4+~cs2.13.13-2
    • 1.22.1+~cs1.3.5-1
    • 1.23.3+~cs1.3.5-1
    • 1.25.0+~cs1.6.0-1
    • 1.25.0+~cs1.6.0-2
    • 1.26.1+~cs1.7.0-1
    • 1.26.1+~cs1.8.0-1
    • 1.27.0+~cs1.8.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Debian:13

    Versions
    • 1.21.4+~cs2.13.13-2
    • 1.22.1+~cs1.3.5-1
    • 1.23.3+~cs1.3.5-1
    • 1.25.0+~cs1.6.0-1
    • 1.25.0+~cs1.6.0-2
    • 1.26.1+~cs1.7.0-1
    • 1.26.1+~cs1.8.0-1
    • 1.27.0+~cs1.8.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Debian:14

    Versions
    • 1.21.4+~cs2.13.13-2
    • 1.22.1+~cs1.3.5-1
    • 1.23.3+~cs1.3.5-1
    • 1.25.0+~cs1.6.0-1
    • 1.25.0+~cs1.6.0-2
    Affected ranges
    • ECOSYSTEM: < 1.26.1+~cs1.7.0-1

    Update to 1.26.1+~cs1.7.0-1

  • re2 npm

    Affected ranges
    • SEMVER: < 1.25.2

    Update to 1.25.2

  • node-re2 Ubuntu:20.04:LTS

    Versions
    • 1.10.4-1
    • 1.10.5-1
    • 1.10.5-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Ubuntu:22.04:LTS

    Versions
    • 1.15.9+~cs1.8.18-1
    • 1.15.9+~cs1.8.18-2
    • 1.16.0+~cs2.12.8-2
    • 1.17.1+~cs2.12.8-1
    • 1.17.2+~cs2.13.8-1
    • 1.17.3+~cs2.13.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Ubuntu:24.04:LTS

    Versions
    • 1.18.0+~cs2.13.8-1build1
    • 1.19.2+~cs2.13.13-1build1
    • 1.20.10+~cs2.13.13-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Ubuntu:26.10

    Versions
    • 1.23.3+~cs1.3.5-1
    • 1.25.0+~cs1.6.0-2
    • 1.26.1+~cs1.7.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Ubuntu:26.04:LTS

    Versions
    • 1.22.1+~cs1.3.5-1
    • 1.22.1+~cs1.3.5-1build2
    • 1.22.1+~cs1.3.5-1build3
    • 1.23.3+~cs1.3.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →