CVE-2026-68499

Name of the Vulnerable Software and Affected Versions re2 versions prior to 1.25.2

Description The String.prototype.match implementation fails to advance its native matching cursor in lib/match.cc when using a global RE2 pattern that can match an empty string. This behavior results in an infinite loop and unbounded native memory growth, which blocks the event loop and can lead to the exhaustion of host memory.

Recommendations Update to version 1.25.2.