CVE-2026-68499
1 advisory.
npm/re2 CVE-2026-68499: medium 6.2
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
Action: Upgrade re2 to 1.25.2 or later.
npm i re2@1.25.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.25.2 | - |
Fixed versions
| 1.25.2 |
Sources
- osv: GHSA-6hxr-mr5r-9836
- https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836
- https://nvd.nist.gov/vuln/detail/CVE-2026-68499
- https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d
- https://github.com/uhop/node-re2
- https://github.com/uhop/node-re2/releases/tag/1.25.2
CVE-2026-68499 · published · modified · JSON