CVE-2026-68499: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Vulnerability summary

CVE-2026-68499 is a medium (CVSS 6.2) Loop with Unreachable Exit Condition vulnerability in uhop node-re2. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 8% of scored vulnerabilities.

Timeline

1. 30-07-2026
   PublishedVulnerability first disclosed.
2. 31-07-2026
   Last modifiedVulnerability information updated.

Description

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

• CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.