CVE-2026-68499

Received Received - Intake

Memory Exhaustion in re2 Regular Expression Engine

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-68499

EUVD

EUVD-2026-51298

Affected Vendors & Products

Vendor	Product	Version / Range
re2	re2	1.25.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability is in the re2 library, which provides Node.js bindings for Google's RE2 regular expression engine. When using String.prototype.match with a global RE2 pattern that can match an empty string, the library fails to advance its matching cursor properly. This causes an infinite loop and unbounded memory growth, blocking the event loop and potentially exhausting host memory.

Detection Guidance

This vulnerability can be detected by checking the version of the re2 library in use. If your system is running re2 version 1.25.2 or higher, it is not vulnerable. Commands to check the version include 'npm list re2' for Node.js projects or inspecting the package.json file.

Impact Analysis

This vulnerability can cause your application to hang or crash due to excessive memory consumption. It may lead to denial of service by consuming all available memory on the host system, disrupting normal operations and requiring a restart to recover.

Compliance Impact

This vulnerability causes unbounded memory growth and event loop blocking, which could lead to denial-of-service conditions. Such disruptions may impact availability of systems handling sensitive data, potentially violating compliance requirements for GDPR (data availability) and HIPAA (system reliability for protected health information).

Mitigation Strategies

Immediately update the re2 library to version 1.25.2 or later. For Node.js projects, run 'npm update re2' or update the dependency in package.json and reinstall dependencies. Restart affected applications to apply the fix.

Hi! I’m here to help you understand CVE-2026-68499. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70