AIKIDO-2026-10502
re2js is vulnerable to Prototype Pollution
72
High Risk
This Affects:
re2jsTL;DR
Affected versions of this package are affected by a Prototype Pollution vulnerability in the getNamedGroups method, where an ordinary object was created with {} and could inherit or interact with dangerous prototype properties. By supplying specially crafted group names such as __proto__, constructor, or prototype, an attacker may be able to pollute the object prototype chain, causing unexpected property injection, application logic manipulation, denial of service, or unsafe behavior in downstream code that trusts the returned object.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
re2js is vulnerable to Prototype Pollution in versions 2.1.0 - 2.1.0.
How to fix this
Upgrade the re2js library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant