Listen to this Post
CVE-2026-68499 is a vulnerability in the `node-re2` package, which provides Node.js bindings for Google’s RE2 regular expression engine. The flaw resides in the native implementation of `String.prototype.match` when used with a global (/g) RE2 object.
The core issue is an infinite loop that occurs when the regular expression pattern can match an empty string (zero-width match). Patterns like a, b?, x{0,3}, (a)|, or `(?:)` are all capable of matching the empty string.
When `String.prototype.match` is called with such a pattern, the native code enters a loop to collect all matches. In each iteration, it advances a cursor (byteIndex) by the length of the match found. For a zero-width match, the length is 0, meaning the cursor does not advance. The next iteration finds the same empty match at the same position, and the loop repeats indefinitely.
This results in an ever-growing native vector (groups) that stores the matches, leading to unbounded memory consumption. The loop runs in synchronous native code, which blocks the entire Node.js event loop. This makes the process unresponsive and immune to standard JavaScript interruption techniques like try/catch, AbortController, or `–max-old-space-size` flags. The only way to stop it is to externally kill the process (e.g., with SIGKILL).
This behavior diverges from the built-in JavaScript engine, where `’xxxx’.match(/a/g)` correctly returns a finite array of empty strings. The vulnerability was introduced because the global match loop in `lib/match.cc` lacked a guard for zero-width matches, a check that was already present in other methods like `split` and exec.
DailyCVE Form
Platform: node-re2
Version: < 1.25.2
Vulnerability: Infinite Loop
Severity: Medium (CVSS 6.2)
Date: 2026-07-30
Prediction: 2026-07-30 (Fixed)
What Undercode Say
Install the vulnerable version npm install [email protected]
// Proof of Concept - Vulnerable Code
const RE2 = require('re2');
// This will cause an infinite loop and never return
'x'.match(new RE2('a', 'g'));
// Other patterns that trigger the issue:
// 'x'.match(new RE2('b?', 'g'));
// 'x'.match(new RE2('x{0,3}', 'g'));
// 'x'.match(new RE2('(a)|', 'g'));
// 'x'.match(new RE2('(?:)', 'g'));
// ''.match(new RE2('a', 'g')); // Also triggers on an empty subject
Analytics:
- A single request can wedge a worker and exhaust host memory in seconds.
- On a clean
npm install [email protected], resident memory grew from ~550 MB to 2.3 GB in ~3 seconds at 100% CPU. - The process had to be killed with `SIGKILL` externally.
- Reachable remotely without authentication wherever user input influences the pattern or subject.
Exploit
An attacker can exploit this vulnerability by providing a regular expression pattern that can match an empty string as input to an application that uses `re2` with a global flag.
For example, if an application allows a user to supply a search pattern and uses `re2` to perform a global match, an attacker could supply `a` or `b?` as the pattern.
// Example of an exploitable pattern in an application const userPattern = 'a'; // Attacker-controlled input const userSubject = 'some text'; const result = userSubject.match(new RE2(userPattern, 'g')); // Vulnerable call
This single request will cause the Node.js process to hang, consume all available memory, and become unresponsive, effectively performing a Denial of Service (DoS) attack.
Protection
- Upgrade: The primary and most effective protection is to upgrade to `[email protected]` or any later version.
npm install [email protected]
- Workaround: If an immediate upgrade is not possible, avoid using the global (
/g) flag with `String.prototype.match` on a `RE2` object when the pattern is attacker-influenced or can match an empty string. Use `matchAll` or `exec` instead, as these methods already handle zero-width matches correctly.// Safer alternatives const re = new RE2('a', 'g'); 'x'.matchAll(re); // Safe re.exec('x'); // Safe
Impact
- Denial of Service (DoS) : The primary impact is a denial of service. An attacker can crash or make a Node.js application unresponsive with a single request.
- Event Loop Blocking: The infinite loop runs in synchronous native code, completely blocking the event loop and preventing the application from handling any other requests.
- Memory Exhaustion: The unbounded growth of the match vector quickly exhausts available memory, potentially affecting not just the application worker but the entire host system.
- No Interruption: The process cannot be recovered through standard JavaScript error handling or resource limits, requiring external intervention (process kill).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
