re2, the Node.js bindings for Google's RE2 regex engine, contains a flaw in its String.prototype.match implementation. When a global regex pattern can match the empty string, the native matching cursor fails to advance in lib/match.cc. This leads to an infinite loop and unbounded allocation of native memory, which blocks the JavaScript event loop and can exhaust host memory. The result is a denial‑of‑service condition that can be triggered by supplying malicious input that uses such a pattern.

All releases of the node-re2 library from uhop before version 1.25.2 are affected. The fix was introduced in the 1.25.2 release. Systems that incorporate this library without upgrading to 1.25.2 or newer are vulnerable.

The CVSS score of 6.2 indicates a medium severity, while the EPSS score of less than 1% suggests that exploitation attempts are expected to be rare. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve feeding specially crafted input that causes String.prototype.match to be executed with a global pattern capable of matching the empty string. An attacker with the ability to influence this input—whether locally or remotely—can trigger the infinite loop, stall the event loop, and drain system memory, effectively denying service. No privileged execution or remote exploitation beyond the ability to run code in the affected process is required.