CVE-2026-68499

What it actually does

Global RE2 regex patterns that match the empty string cause String.prototype.match to fail advancing its native cursor in lib/match.cc, resulting in an infinite loop with unbounded native memory allocation that blocks the event loop.

Why it matters to the business

Applications become unresponsive or crash from memory exhaustion, leading to service outages and potential loss of availability for any workloads relying on the vulnerable library.

How an attack unfolds

An attacker supplies a crafted global RE2 pattern capable of matching the empty string to an application that invokes match on attacker-controlled or untrusted input, triggering the cursor advancement bug and consuming host memory until the process is terminated or the system runs out of resources.

How to fix it

Upgrade re2 to version 1.25.2 or later; after upgrade, validate that all dependent packages pull the corrected release and restart affected Node.js processes.

How to confirm the fix worked

Confirm installed version is at least 1.25.2 via package manager or require.resolve; execute a test case using a global empty-matching pattern to verify the loop no longer occurs and memory remains bounded.

Typical attack path

1. Identify an application endpoint or function that accepts regex patterns or uses re2 for matching on user-supplied data
2. Craft a global RE2 pattern that matches the empty string
3. Invoke the vulnerable match operation repeatedly or with large input to accelerate memory growth
4. Observe event-loop blockage or process termination due to memory exhaustion

How to detect it

Review application logs for sudden spikes in memory usage or event-loop stalls coinciding with regex match operations; correlate with process crashes or OOM killer events in system logs.

What your security team should do

• Immediately upgrade all instances of re2 to 1.25.2 or newer
• Scan dependency trees for transitive usage of the vulnerable package
• Add runtime resource limits and monitoring for Node.js event-loop lag and native memory usage
• Review any code paths that allow untrusted input to influence regex construction or matching