CVE-2026-68499: re2 Package Suffers from Infinite Loop and Memory Growth Due to Global Empty Match Pattern
Summary
CVE-2026-68499: String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. Affects re2 versions < 1.25.2. Fixed in 1.25.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The re2 package is a JavaScript library that provides a fast and safe way to work with regular expressions. It is designed to handle complex pattern matching while avoiding the pitfalls of traditional regex engines, such as catastrophic backtracking. However, a vulnerability has been identified in the global matching functionality of re2, specifically when using patterns that can match empty strings. This issue can lead to significant performance degradation and potential denial of service (DoS) conditions.
Vulnerability Detail
The vulnerability arises from the global String.prototype.match method when used with an empty-matchable pattern in the re2 library. The matching process collects all matches in a loop that advances the cursor by the length of the match. Since a zero-width match has a length of 0, the cursor does not advance, causing the same empty match to be found repeatedly. This results in an infinite loop that consumes unbounded native memory, blocking the event loop and leading to a denial of service. The issue is exacerbated when the pattern or subject is influenced by user input, making it a significant security risk.
How To Fix
Latest published version: 1.27.0 as of 23 Oct 2026
npm install re2@1.27.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.25.2
This is the first release that contains the fix.
npm install re2@1.25.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, avoid using a global re2 match with patterns that can match empty strings on user-influenced input. Instead, consider using the non-global form of the match or iterate with matchAll or exec, which correctly advance the cursor. Here is an example of using exec:
const RE2 = require('re2');
const regex = new RE2('a*');
let match;
while ((match = regex.exec('x')) !== null) {
console.log(match);
}
Conclusion
The re2 package has a significant vulnerability that can lead to infinite loops and memory growth when using global matches with empty-matchable patterns. It is crucial to upgrade to version 1.25.2 or later to mitigate this risk. Users should also consider workarounds if immediate upgrades are not feasible.
See every vulnerability recorded for re2 →
FAQ
The CVSS score of this vulnerability is 6.2, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup at Vulert Scanner.
The vulnerability can lead to denial of service (DoS) conditions, where the application becomes unresponsive due to excessive memory consumption.
Yes, the vulnerability can be exploited remotely and without authentication, especially if user input influences the regex pattern or subject.
If you cannot upgrade, avoid using global re2 matches with empty-matchable patterns on user input. Use alternative methods like matchAll or exec.
References
Related vulnerabilities
Recent vulnerabilities recorded for re2.
