CVE-2026-68499

{
  "id": "CVE-2026-68499",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-30T21:18:12.870",
  "lastModified": "2026-10-23T22:10:00.160",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2."
    },
    {
      "lang": "es",
      "value": "re2 proporciona enlaces para Node.js para el motor de expresiones regulares RE2 de Google. Antes de la versión 1.25.2, la implementación de String.prototype.match de re2 con un patrón RE2 global que puede coincidir con la cadena vacía no logra avanzar su cursor de coincidencia nativo en lib/match.cc, causando un bucle infinito y un crecimiento ilimitado de la memoria nativa que bloquea el bucle de eventos y puede agotar la memoria del host. Este problema está solucionado en la versión 1.25.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "uhop",
          "product": "node-re2",
          "versions": [
            {
              "version": "< 1.25.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-31T19:18:39.668208Z",
          "id": "CVE-2026-68499",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/uhop/node-re2/releases/tag/1.25.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}