CVE-2026-68499 Details

A denial-of-service vulnerability has been identified in the re2 library, which provides Node.js bindings for Google's RE2 regular expression engine. This issue affects versions of re2 through 1.25.1. The vulnerability arises when the library's String.prototype.match method is used with a global RE2 pattern that can match empty strings. In such cases, the matching cursor fails to progress, leading to an infinite loop and unbounded growth of native memory. This memory exhaustion blocks the event loop, causing the application to become unresponsive and potentially exhausting the host's resources.

Users can upgrade to re2 version 1.25.2 or later, where this vulnerability has been fixed. If an upgrade is not possible, avoid using global RE2 patterns in String.prototype.match with attacker-influenced data. Instead, use matchAll or exec, or the non-global form of the pattern, both of which handle the cursor advancement correctly.