Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-68499 EUVD-2026-51298GHSA-6hxr-mr5r-9836

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Published Jul 30, 2026 · Updated Jul 31, 2026 · Assigned by GitHub_M

Description

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

Affected products

VendorProductAffectedFixed
uhop node-re2 < 1.25.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-re2 1.26.1+~cs1.7.0-1 —
Debian 13 node-re2 No fix yet —
Debian 12 node-re2 No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-re2 No fix yet —
Ubuntu 26.04 LTS node-re2 No fix yet —
Ubuntu 24.04 LTS node-re2 No fix yet —
Ubuntu 22.04 LTS node-re2 No fix yet —
Ubuntu 20.04 LTS node-re2 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
npm re2 < 1.25.2 1.25.2 GHSA-6hxr-mr5r-9836

References