Threats tagged 'ghsa-6hxr-mr5r-9836'

CVE-2026-68499 is a vulnerability in the node-re2 package, which provides Node.js bindings for Google's RE2 regular expression engine. Versions prior to 1.25.2 have a flaw in the String.prototype.match implementation when using a global RE2 pattern that can match the empty string. This causes an infinite loop due to failure to advance the matching cursor, leading to unbounded native memory growth, blocking the event loop and potentially exhausting host memory. The issue is fixed in version 1.25.2.