CVE-2026-68499
CVE-2026-68499 in the re2 Node.js binding is being labeled CVSS 6.2, which badly understates the operational risk. The vulnerability occurs when a regex pattern with the global flag matches an empty string — the matcher enters an infinite loop that blocks the Node.js event loop entirely. In a single-process Node.js service, this doesn't just fail one request; it hangs every concurrent request, stalls timers, and backs up all pending I/O. The event loop is the service, and blocking it is a total availability failure, not medium-severity behavior. The trigger condition is more accessible than the CVSS suggests. The global flag is commonly added to patterns in search-and-replace operations, log parsing, input sanitization, and data transformation pipelines. Patterns with optional components, character classes, or wildcards can match empty strings against empty inputs — exactly the kind of pattern written when you want 'find all occurrences of X.' User-supplied regex in API handlers and validation pipelines makes this a realistic attack vector, not a theoretical edge case. Worse, re2 is frequently a transitive dependency, not a direct one. Many Node.js packages depend on re2 indirectly. This means the actual attack surface includes services whose developers may not even know they're exposed. The patch in 1.25.2 exists, but propagating it through transitive dependency chains takes time — organizations can't patch what they don't know they depend on. Treat this as a critical priority. Update re2 to 1.25.2 or later in your dependency tree immediately. Audit services that accept user-supplied regex patterns, particularly those using the global flag. If you're running re2 in a containerized environment, consider aggressive memory limits and process restarts on unbounded loop detection, because once triggered, the only recovery is process restart. The CVSS label is a documentation artifact; the operational reality is service-stopping.
Reviewed through automated stages and approved by a human before publication.