UBUNTU-CVE-2026-67550

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII...

CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-67550 re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII...

CVE-2026-67550 re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII...

CVE-2026-67550

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII...

CVE-2026-67550

CVE-2026-67550 affects re2 Node.js bindings for Google's RE2 engine. Before version 1.25.2, lastIndex is validated against the subject’s UTF-8 byte length but used as a UTF-16 code-unit offset in exec/test/match/replace/split, enabling an attacker-influenced lastIndex on a non-ASCII subject to tr...

CVE-2026-67550

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII...

CVE-2026-67550 re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII...

CVE-2026-68499: Loop with Unreachable Exit Condition

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-67550: Out-of-bounds Read

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII...

PT-2026-66604

Name of the Vulnerable Software and Affected Versions re2 versions prior to 1.25.2 Description The software validates lastIndex against the UTF-8 byte length of a subject but incorrectly uses it as a UTF-16 code-unit offset in the exec, test, match, replace, and split functions. When a non-ASCII...

jsoup:CssHtmlFuzzer: Security exception in com.google.re2j.Machine.add

Project: https://github.com/jhy/jsoup.git Detailed Report: https://oss-fuzz.com/testcase?key=4568001644134400 Project: jsoup Fuzzing Engine: libFuzzer Fuzz Target: CssHtmlFuzzer Job Type: libfuzzerasanjsoup Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Malicious code in irashi-21-re2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f10798ca54546bde1805c7566ff214c575d1b5a13fc2d3154f73b32d16f7167 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

envoy:rbac_filter_fuzz_test: Heap-buffer-overflow in re2::RE2::Rewrite

Detailed Report: https://oss-fuzz.com/testcase?key=5583271099695104 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: rbacfilterfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x51d00008a028 Crash State: re2::RE2::Rewrite...

SUSE: Security Advisory (SUSE-SU-2024:0573-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:0573-1 Security update for abseil-cpp, grpc, opencensus-proto, protobuf, python-abseil, python-grpcio, re2

This update for abseil-cpp, grpc, opencensus-proto, protobuf, python-abseil, python-grpcio, re2 fixes the following issues: abseil-cpp was updated to: Update to 20230802.1: Add StdcppWaiter to the end of the list of waiter implementations Update to 20230802.0 What's New: Added the nullability...

OSV-2021-921 Stack-buffer-overflow in bool re2::DFA::InlinedSearchLoop<true, true, true>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35821 Crash type: Stack-buffer-overflow READ 1 Crash state: bool re2::DFA::InlinedSearchLoop re2::DFA::Search re2::Prog::SearchDFA...