Vulnerability-Lookup

CVE-2026-68499 (GCVE-0-2026-68499)

Vulnerability from cvelistv5 – Published: 2026-07-30 20:07 – Updated: 2026-07-31 19:19

Title

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Summary

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-31 19:18 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/uhop/node-re2/security/advisor…	x_refsource_CONFIRM
https://github.com/uhop/node-re2/commit/56293de4f…	x_refsource_MISC
https://github.com/uhop/node-re2/releases/tag/1.25.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
uhop	node-re2	Affected: < 1.25.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68499",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T19:18:39.668208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T19:19:08.646Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-re2",
          "vendor": "uhop",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.25.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "re2 provides Node.js bindings for Google\u0027s RE2 regular expression engine. Prior to 1.25.2, re2\u0027s String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T20:07:01.147Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836"
        },
        {
          "name": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d"
        },
        {
          "name": "https://github.com/uhop/node-re2/releases/tag/1.25.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/uhop/node-re2/releases/tag/1.25.2"
        }
      ],
      "source": {
        "advisory": "GHSA-6hxr-mr5r-9836",
        "discovery": "UNKNOWN"
      },
      "title": "re2: Global `String.prototype.match` with an empty-matchable pattern never advances \u2192 infinite loop with unbounded native memory growth (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68499",
    "datePublished": "2026-07-30T20:07:01.147Z",
    "dateReserved": "2026-07-30T16:19:08.081Z",
    "dateUpdated": "2026-07-31T19:19:08.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68499",
      "date": "2026-09-16",
      "epss": "0.00188",
      "percentile": "0.087"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68499\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-30T21:18:12.870\",\"lastModified\":\"2026-09-10T20:30:11.423\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"re2 provides Node.js bindings for Google\u0027s RE2 regular expression engine. Prior to 1.25.2, re2\u0027s String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"uhop\",\"product\":\"node-re2\",\"versions\":[{\"version\":\"\u003c 1.25.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-31T19:18:39.668208Z\",\"id\":\"CVE-2026-68499\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"references\":[{\"url\":\"https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/uhop/node-re2/releases/tag/1.25.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-68499\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-31T19:18:39.668208Z\"}}}], \"references\": [{\"url\": \"https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-31T19:19:01.238Z\"}}], \"cna\": {\"title\": \"re2: Global `String.prototype.match` with an empty-matchable pattern never advances \\u2192 infinite loop with unbounded native memory growth (DoS)\", \"source\": {\"advisory\": \"GHSA-6hxr-mr5r-9836\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"uhop\", \"product\": \"node-re2\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.25.2\"}]}], \"references\": [{\"url\": \"https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836\", \"name\": \"https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d\", \"name\": \"https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/uhop/node-re2/releases/tag/1.25.2\", \"name\": \"https://github.com/uhop/node-re2/releases/tag/1.25.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"re2 provides Node.js bindings for Google\u0027s RE2 regular expression engine. Prior to 1.25.2, re2\u0027s String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-30T20:07:01.147Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-68499\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-31T19:19:08.646Z\", \"dateReserved\": \"2026-07-30T16:19:08.081Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-30T20:07:01.147Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-68499

Vulnerability from fkie_nvd - Published: 2026-07-30 21:18 - Updated: 2026-09-10 20:30

Severity

6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d
	security-advisories@github.com	https://github.com/uhop/node-re2/releases/tag/1.25.2
	security-advisories@github.com	https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "node-re2",
          "vendor": "uhop",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.25.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "re2 provides Node.js bindings for Google\u0027s RE2 regular expression engine. Prior to 1.25.2, re2\u0027s String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2."
    }
  ],
  "id": "CVE-2026-68499",
  "lastModified": "2026-09-10T20:30:11.423",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-68499",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-31T19:18:39.668208Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-30T21:18:12.870",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/uhop/node-re2/releases/tag/1.25.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6HXR-MR5R-9836

Vulnerability from github – Published: 2026-07-31 16:53 – Updated: 2026-07-31 16:53

Summary

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Details

Summary

String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. A zero-width (empty) match has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any pattern that can match the empty string (a*, b?, x{0,3}, (a)|, (?:), …) therefore causes an infinite loop with unbounded memory growth. The call is synchronous native code, so it blocks the entire event loop and cannot be interrupted by try/catch, AbortController, --max-old-space-size, or timers — the process must be killed externally. This diverges from the built-in engine, where 'xxxx'.match(/a*/g) returns a finite array.

Root cause

// lib/match.cc:44 — global branch of WrappedRE2::Match
while (re2->regexp.Match(str, byteIndex, str.size, anchor, &match, 1)) {
    groups.push_back(match);
    byteIndex = match.data() - str.data + match.size();   // += 0 for a zero-width match
}

When match.size() == 0, byteIndex is unchanged, so the next iteration matches the same empty position again; groups grows without bound. The other iteration paths already guard this: lib/split.cc:50-55 advances by getUtf8CharSize on an empty match, and exec advances lastIndex. Only this global Match loop is missing the guard.

Proof of concept

const RE2 = require('re2');
'x'.match(new RE2('a*', 'g'));   // never returns; grows memory until OOM
// also: 'b?', 'x{0,3}', '(a)|', 'c*d*', '(?:)'; empty subject '' triggers it too

Compare with the built-in engine, which terminates:

'xxxx'.match(/a*/g);   // -> ["", "", "", "", ""]

Measured on a clean npm install re2@1.25.1 (latest), stock prebuilt binary: resident memory grew ~550 MB → 2.3 GB in ~3 seconds at 100% CPU, and the process had to be SIGKILLed externally.

Impact

Denial of service. Reachable remotely and without authentication wherever an application runs a global RE2 through String.prototype.match and either the pattern or the subject is attacker-influenced — e.g. a user-supplied regular expression, or a fixed empty-matchable pattern applied to user input. Because the loop blocks the event loop and exhausts memory in seconds, a single request can wedge a worker and, via memory exhaustion, affect the whole host.

Suggested fix

Mirror the empty-match handling already present in split.cc: when the match is zero-width, advance the cursor by one code point.

// lib/match.cc, inside the global while-loop
groups.push_back(match);
size_t off = match.data() - str.data;
if (match.size()) {
    byteIndex = off + match.size();
} else {
    byteIndex = off + (off < str.size ? getUtf8CharSize(str.data[off]) : 1);
}

Resolution

Fixed in re2 1.25.2.

The global match loop in lib/match.cc now advances the cursor by one Unicode code point when a match is zero-width, so a pattern that can match the empty string terminates with a finite result identical to the built-in engine ('xxxx'.match(/a*/g) returns five empty strings). This mirrors the guard already present in split.

Remediation: upgrade to re2@1.25.2 or later.

Workaround (if you cannot upgrade): do not run a global RE2 through String.prototype.match when the pattern is attacker-influenced or can match the empty string. Iterate with matchAll/exec, or use the non-global form; both already advanced the cursor correctly.

Severity

6.2 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.25.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "re2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T16:53:08Z",
    "nvd_published_at": "2026-07-30T21:18:12Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`String.prototype.match` with a **global** `RE2` collects all matches in a native loop that advances the cursor by the match length. A **zero-width (empty) match** has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any pattern that can match the empty string (`a*`, `b?`, `x{0,3}`, `(a)|`, `(?:)`, \u2026) therefore causes an infinite loop with unbounded memory growth. The call is synchronous native code, so it blocks the entire event loop and cannot be interrupted by `try/catch`, `AbortController`, `--max-old-space-size`, or timers \u2014 the process must be killed externally. This diverges from the built-in engine, where `\u0027xxxx\u0027.match(/a*/g)` returns a finite array.\n\n## Root cause\n\n```cpp\n// lib/match.cc:44 \u2014 global branch of WrappedRE2::Match\nwhile (re2-\u003eregexp.Match(str, byteIndex, str.size, anchor, \u0026match, 1)) {\n    groups.push_back(match);\n    byteIndex = match.data() - str.data + match.size();   // += 0 for a zero-width match\n}\n```\n\nWhen `match.size() == 0`, `byteIndex` is unchanged, so the next iteration matches the same empty position again; `groups` grows without bound. The other iteration paths already guard this: `lib/split.cc:50-55` advances by `getUtf8CharSize` on an empty match, and `exec` advances `lastIndex`. Only this global `Match` loop is missing the guard.\n\n## Proof of concept\n\n```js\nconst RE2 = require(\u0027re2\u0027);\n\u0027x\u0027.match(new RE2(\u0027a*\u0027, \u0027g\u0027));   // never returns; grows memory until OOM\n// also: \u0027b?\u0027, \u0027x{0,3}\u0027, \u0027(a)|\u0027, \u0027c*d*\u0027, \u0027(?:)\u0027; empty subject \u0027\u0027 triggers it too\n```\n\nCompare with the built-in engine, which terminates:\n\n```js\n\u0027xxxx\u0027.match(/a*/g);   // -\u003e [\"\", \"\", \"\", \"\", \"\"]\n```\n\nMeasured on a clean `npm install re2@1.25.1` (latest), stock prebuilt binary: resident memory grew **~550 MB \u2192 2.3 GB in ~3 seconds** at 100% CPU, and the process had to be `SIGKILL`ed externally.\n\n## Impact\n\nDenial of service. Reachable remotely and without authentication wherever an application runs a **global** `RE2` through `String.prototype.match` and either the pattern or the subject is attacker-influenced \u2014 e.g. a user-supplied regular expression, or a fixed empty-matchable pattern applied to user input. Because the loop blocks the event loop and exhausts memory in seconds, a single request can wedge a worker and, via memory exhaustion, affect the whole host.\n\n## Suggested fix\n\nMirror the empty-match handling already present in `split.cc`: when the match is zero-width, advance the cursor by one code point.\n\n```cpp\n// lib/match.cc, inside the global while-loop\ngroups.push_back(match);\nsize_t off = match.data() - str.data;\nif (match.size()) {\n    byteIndex = off + match.size();\n} else {\n    byteIndex = off + (off \u003c str.size ? getUtf8CharSize(str.data[off]) : 1);\n}\n```\n\n## Resolution\n\nFixed in re2 1.25.2.\n\nThe global match loop in `lib/match.cc` now advances the cursor by one Unicode\ncode point when a match is zero-width, so a pattern that can match the empty\nstring terminates with a finite result identical to the built-in engine\n(`\u0027xxxx\u0027.match(/a*/g)` returns five empty strings). This mirrors the guard\nalready present in `split`.\n\n**Remediation:** upgrade to `re2@1.25.2` or later.\n\n**Workaround** (if you cannot upgrade): do not run a global `RE2` through\n`String.prototype.match` when the pattern is attacker-influenced or can match\nthe empty string. Iterate with `matchAll`/`exec`, or use the non-global form;\nboth already advanced the cursor correctly.",
  "id": "GHSA-6hxr-mr5r-9836",
  "modified": "2026-07-31T16:53:08Z",
  "published": "2026-07-31T16:53:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/uhop/node-re2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uhop/node-re2/releases/tag/1.25.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "re2: Global `String.prototype.match` with an empty-matchable pattern never advances \u2192 infinite loop with unbounded native memory growth (DoS)"
}

ubuntu-cve-2026-68499

Vulnerability from osv_ubuntu

Published

2026-07-30 21:18

Modified

2026-08-06 00:23

Summary

Details

Severity

6.2 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-68499	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-68499	REPORT
	https://github.com/uhop/node-re2/security/advisor…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.10.5-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.10.5-1build1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.4-1",
        "1.10.5-1",
        "1.10.5-1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.17.3+~cs2.13.8-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.17.3+~cs2.13.8-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.15.9+~cs1.8.18-1",
        "1.15.9+~cs1.8.18-2",
        "1.16.0+~cs2.12.8-2",
        "1.17.1+~cs2.12.8-1",
        "1.17.2+~cs2.13.8-1",
        "1.17.3+~cs2.13.8-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.20.10+~cs2.13.13-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.20.10+~cs2.13.13-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.18.0+~cs2.13.8-1build1",
        "1.19.2+~cs2.13.13-1build1",
        "1.20.10+~cs2.13.13-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.23.3+~cs1.3.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.23.3+~cs1.3.5-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.22.1+~cs1.3.5-1",
        "1.22.1+~cs1.3.5-1build2",
        "1.22.1+~cs1.3.5-1build3",
        "1.23.3+~cs1.3.5-1"
      ]
    }
  ],
  "aliases": [],
  "details": "re2 provides Node.js bindings for Google\u0027s RE2 regular expression engine. Prior to 1.25.2, re2\u0027s String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.",
  "id": "UBUNTU-CVE-2026-68499",
  "modified": "2026-08-06T00:23:23Z",
  "published": "2026-07-30T21:18:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-68499"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68499"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-68499"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-68499 (GCVE-0-2026-68499)

FKIE_CVE-2026-68499

GHSA-6HXR-MR5R-9836

Summary

Root cause

Proof of concept

Impact

Suggested fix

Resolution

ubuntu-cve-2026-68499

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour