diff --git a/CHANGES b/CHANGES
index 1bfc9eada8..a9e2fe9c06 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,8 @@
 
+3.1.0-dev.309 | 2019-12-16 09:40:01 -0800
+
+  * GHI-599: avoid memory leak with default pattern matching and json formatting (Tim Wojtulewicz, Corelight)
+
 3.1.0-dev.307 | 2019-12-16 08:20:58 -0800
 
   * Update URL for Malware Hash Registry website (Jon Siwek, Corelight)
diff --git a/VERSION b/VERSION
index a4e7037090..6ec62eaf8b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.1.0-dev.307
+3.1.0-dev.309
diff --git a/src/Val.cc b/src/Val.cc
index 7f2cad149b..907a29d062 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -429,7 +429,7 @@ TableVal* Val::GetRecordFields()
 	}
 
 // This is a static method in this file to avoid including json.hpp in Val.h since it's huge.
-static ZeekJson BuildJSON(Val* val, bool only_loggable=false, RE_Matcher* re=new RE_Matcher("^_"))
+static ZeekJson BuildJSON(Val* val, bool only_loggable=false, RE_Matcher* re=nullptr)
 	{
 	// If the value wasn't set, return a nullptr. This will get turned into a 'null' in the json output.
 	if ( ! val )
@@ -562,7 +562,7 @@ static ZeekJson BuildJSON(Val* val, bool only_loggable=false, RE_Matcher* re=new
 				auto field_name = rt->FieldName(i);
 				std::string key_string;
 
-				if ( re->MatchAnywhere(field_name) != 0 )
+				if ( re && re->MatchAnywhere(field_name) != 0 )
 					{
 					StringVal blank("");
 					StringVal fn_val(field_name);
diff --git a/src/Val.h b/src/Val.h
index 09e8858e61..50b3b7a20f 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -348,7 +348,7 @@ public:
 
 	TableVal* GetRecordFields();
 
-	StringVal* ToJSON(bool only_loggable=false, RE_Matcher* re=new RE_Matcher("^_"));
+	StringVal* ToJSON(bool only_loggable=false, RE_Matcher* re=nullptr);
 
 protected: