Source: node-re2 Version: 1.25.0+~cs1.6.0-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for node-re2. CVE-2026-68499[0]: | re2 provides Node.js bindings for Google's RE2 regular expression | engine. Prior to 1.25.2, re2's String.prototype.match implementation | with a global RE2 pattern that can match the empty string fails to | advance its native matching cursor in lib/match.cc, causing an | infinite loop and unbounded native memory growth that blocks the | event loop and can exhaust host memory. This issue is fixed in | 1.25.2. CVE-2026-67550[1]: | re2 provides Node.js bindings for Google's RE2 regular expression | engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 | byte length of a subject but uses it as a UTF-16 code-unit offset in | exec, test, match, replace, and split, allowing an attacker- | influenced lastIndex on a non-ASCII subject to trigger an out-of- | bounds heap read and an uncatchable process crash, with limited heap | information disclosure in some cases. This issue is fixed in 1.25.2. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-68499 https://www.cve.org/CVERecord?id=CVE-2026-68499 https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836 [1] https://security-tracker.debian.org/tracker/CVE-2026-67550 https://www.cve.org/CVERecord?id=CVE-2026-67550 https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj Please adjust the affected versions in the BTS as needed. Regards, Salvatore
