CVE-2026-68499

6.2 Moyenne

Publiée le 30/07/2026 à 23:18 · Modifiée le 10/09/2026 à 22:30 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

Traduire en français

Produits concernés

uhop node-re2

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.2 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-835

Références

https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d
https://github.com/uhop/node-re2/releases/tag/1.25.2
https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836
https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories