Most recent entries from all

EUVD-2026-343461

fkie_cve-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

GHSA-6hxr-mr5r-9836 — re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded nati…

Affected: npm: re2

## Summary

`String.prototype.match` with a **global** `RE2` collects all matches in a native loop that advances the cursor by the match length. A **zero-width (empty) match** has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any pattern that can match the empty string (`a*`, `b?`, `x{0,3}`, `(a)|`, `(?:)`, …) therefore causes an infinite loop with unbounded memory growth. The call is synchronous native code, so it blocks the entire event loop and cannot be interrupted by `try/catch`, `AbortController`, `--max-old-space-size`, or timers — the process must be killed externally. This diverges from the built-in engine, where `'xxxx'.match(/a*/g)` returns a finite array.

## Root cause

```cpp // lib/match.cc:44 — global branch of WrappedRE2::Match while (re2->regexp.Match(str, byteIndex, str.size, anchor, &match, 1)) { groups.push_back(match); byteIndex = match.data() - str.data + match.size(); // += 0 for a zero-width match } ```

When `match.size() == 0`, `byteIndex` is unchanged, so the next iteration matches the same empty position again; `groups` grows without bound. The other iteration paths already guard this: `lib/split.cc:50-55` advances by `getUtf8CharSize` on an empty match, and `exec` advances `lastIndex`. Only this global `Match` loop is missing the guard.

## Proof of concept

```js const RE2 = require('re2'); 'x'.match(new RE2('a*', 'g')); // never returns; grows memory unt…

UBUNTU-CVE-2026-68499

Affected: Ubuntu:20.04:LTS: node-re2, Ubuntu:22.04:LTS: node-re2, Ubuntu:24.04:LTS: node-re2, Ubuntu:26.04:LTS: node-re2