PT-2026-66605 · Uhop · Node-Re2

CVE-2026-68499 · Publicado 2026-07-30 · Atualizado 2026-07-30

Mitre

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2026-68499

Produtos afetados

Node-Re2

Referências · 4

• https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836 · Nota
• https://github.com/uhop/node-re2/releases/tag/1.25.2 · Nota
• https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-68499 · Nota de Segurança