CyberRota Analysis
AI-GeneratedThe re2 library's Node.js bindings prior to version 1.25.2 are vulnerable to an infinite loop and unbounded memory growth when using a global RE2 pattern that matches the empty string. This flaw can lead to event loop blockage and potential exhaustion of host memory, impacting application performance and stability. Developers using affected versions of re2 should prioritize upgrading to version 1.25.2 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.