CVE-2026-71498 Details
Description
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.
A heap buffer over-read vulnerability has been identified in node-re2, a Node.js binding for RE2 regular expressions. This issue affects versions through 1.26.0. The vulnerability arises when a Buffer input ends with a truncated multi-byte UTF-8 lead byte. The native binding miscalculates the byte length of the character, leading to a read of up to three bytes past the end of the Buffer. This out-of-bounds read can disclose adjacent heap memory contents to JavaScript. The vulnerability is present in the 'replace' and 'split' methods, where the over-read bytes are returned in the result Buffer, allowing an attacker to sample heap memory incrementally.
Users are advised to upgrade to node-re2 version 1.26.1 or later. If an upgrade is not possible, Buffers should be validated to ensure they are well-formed UTF-8 before being passed to the RE2 constructor or the 'replace' and 'split' methods.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |