{
  "affected": [
    {
      "affectedData": [
        {
          "product": "node-re2",
          "vendor": "uhop",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.26.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1."
    }
  ],
  "id": "CVE-2026-71498",
  "lastModified": "2026-09-10T20:30:11.423",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-71498",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T14:57:08.840534Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-06T22:18:32.207",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/uhop/node-re2/issues/272"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.26.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "re2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71498"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-06T21:26:14Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`re2` infers a character\u0027s byte length from its UTF-8 lead byte alone, with no bound on the\nbytes actually remaining in the input. `Buffer` arguments reach the native layer verbatim \u2014\nonly strings are re-encoded into well-formed UTF-8 \u2014 so a `Buffer` whose last byte is a\nmulti-byte lead promises continuation bytes that are not there, and the result builders read\nup to 3 bytes past the end of the buffer. In `replace()` and `split()` those bytes are copied\ninto the returned `Buffer`, disclosing adjacent heap memory to JavaScript. The trigger is\ndeterministic and requires no special heap grooming.\n\nOnly `Buffer` input is affected. String input was never at risk: re-encoding guarantees every\nmulti-byte sequence is complete.\n\n## Root cause\n\n`getUtf8CharSize` maps a lead byte to a length of 1\u20134 and never sees the input size:\n\n```cpp\n// lib/wrapped_re2.h\ninline size_t getUtf8CharSize(char ch)\n{\n      return ((0xE5000000 \u003e\u003e ((ch \u003e\u003e 3) \u0026 0x1E)) \u0026 3) + 1;\n}\n```\n\nCallers then read that many bytes. In the zero-width branch of `replace()`, the guard proves\nonly that at least *one* byte remains:\n\n```cpp\n// lib/replace.cc\nelse if ((size_t)offset \u003c size)\n{\n      auto sym_size = getUtf8CharSize(data[offset]);   // may claim up to 4 bytes\n      result.append(data + offset, sym_size);          // reads data[offset .. offset + 3]\n      byteIndex = offset + sym_size;\n}\n```\n\n`offset \u003c size` permits `offset == size - 1`, so a lead byte of `0xF0` makes `append` read\n`data[size]`, `data[size + 1]` and `data[size + 2]`.\n\nSeven read sites shared the defect:\n\n| Site | Argument | Disclosed to JS |\n|---|---|---|\n| `lib/replace.cc` (zero-width branch) | subject | yes |\n| `lib/replace.cc` (callback replacer) | subject | yes |\n| `lib/replace.cc` (replacement scan) | replacement | yes |\n| `lib/split.cc` | subject | yes |\n| `lib/pattern.cc` `translateRegExp` (x2) | pattern | no |\n| `lib/pattern.cc` `escapeRegExp` | pattern | no |\n\nThree further callers were **not** vulnerable, because they use the result only to advance an\nindex and never dereference past the end: `getUtf16PositionByCounter` in `lib/wrapped_re2.h`\n(clamps its return to the buffer size), `lib/match.cc` (the value feeds `RE2::Match`, which\nrejects `startpos \u003e endpos`), and the `getMaxSubmatch` scan in `lib/replace.cc` (an overshoot\njust ends the loop).\n\n## Proof of concept\n\nEach call returns more bytes than were supplied; the trailing bytes are heap contents and vary\nbetween runs.\n\n```js\nconst RE2 = require(\u0027re2\u0027);\nconst hex = buf =\u003e [...buf].map(b =\u003e b.toString(16).padStart(2, \u00270\u0027)).join(\u0027 \u0027);\n\n// subject: 2 bytes in, 5 bytes out\nconsole.log(hex(new RE2(\u0027\u0027, \u0027g\u0027).replace(Buffer.from([0x41, 0xf0]), \u0027\u0027)));\n// 41 f0 61 7b eb   \u003c- last 3 bytes are adjacent heap memory\n\n// replacement argument\nconsole.log(hex(new RE2(\u0027A\u0027, \u0027g\u0027).replace(Buffer.from(\u0027A\u0027), Buffer.from([0x42, 0xf0]))));\n// 42 f0 41 26 d6\n\n// split\nconsole.log(new RE2(\u0027\u0027, \u0027g\u0027).split(Buffer.from([0x41, 0xf0])).map(hex));\n// [ \u002741\u0027, \u0027f0 e2 e4 df\u0027 ]\n```\n\n`0xC2` (2-byte lead) and `0xE2` (3-byte lead) over-read 1 and 2 bytes respectively; `0xF0`\nover-reads 3.\n\nFor the pattern path the over-read occurs in `translateRegExp` / `escapeRegExp`, which run\nbefore RE2 validates the pattern, but RE2 then rejects the malformed input, so the bytes are\ndiscarded rather than returned:\n\n```js\nnew RE2(Buffer.from([0xf0]));   // SyntaxError: invalid UTF-8 \u2014 read already happened\n```\n\n## Impact\n\n**Information disclosure (`replace`, `split`).** Up to 3 bytes of heap memory adjacent to the\ninput buffer are returned to JavaScript per call. The read is repeatable, so an attacker who\ncontrols `Buffer` input and observes output can sample heap memory incrementally. What lands\nthere depends on allocator layout and is not directly steerable, but it may include fragments\nof other buffers.\n\n**Out-of-bounds read (pattern compilation).** No disclosure path, since the malformed pattern\nis rejected \u2014 but the read is still undefined behavior and can fault if the buffer ends on a\npage boundary.\n\nApplications that pass only strings, or only well-formed UTF-8 buffers, are unaffected. The\nexposure matters most where `re2` is used as intended: running patterns or subjects derived\nfrom untrusted input.\n\n## Suggested fix\n\nClamp the inferred character size to the bytes that actually remain, at every site whose result\nindexes the buffer:\n\n```cpp\ninline size_t getUtf8CharSize(char ch, size_t remaining)\n{\n      size_t size = getUtf8CharSize(ch);\n      return size \u003c remaining ? size : remaining;\n}\n```\n\nThis is O(1) and changes no algorithm\u0027s complexity. A truncated tail then round-trips as the\nbytes it really holds, which preserves the documented contract that `Buffer` input is passed\nthrough verbatim. Rejecting malformed UTF-8 in `Buffer` input would also close the hole, but\nis a breaking API change.\n\n## Resolution\n\nFixed in `re2@1.26.1`.\n\nAll seven read sites now clamp the character size to the remaining input, so a `Buffer` ending\nin a truncated multi-byte character round-trips as its own bytes instead of reading past the\nend. Regression tests cover the subject, replacement and pattern positions for 2-, 3- and\n4-byte leads, including partially truncated sequences.\n\n**Remediation:** upgrade to `re2@1.26.1` or later.\n\n**Workaround** (if you cannot upgrade): pass strings rather than `Buffer`s, or validate that\n`Buffer` input is well-formed UTF-8 before calling `replace`, `split`, or the `RE2`\nconstructor \u2014 for example `Buffer.compare(Buffer.from(buf.toString(\u0027utf8\u0027)), buf) === 0`.\n\nReported by [@OvOhao](https://github.com/OvOhao) in [#272](https://github.com/uhop/node-re2/issues/272).",
  "id": "GHSA-j4r3-hg7j-8chg",
  "modified": "2026-08-06T21:26:14Z",
  "published": "2026-08-06T21:26:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uhop/node-re2/issues/272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/uhop/node-re2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character \u2192 adjacent heap memory disclosed to JavaScript"
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.10.5-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.10.5-1build1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.4-1",
        "1.10.5-1",
        "1.10.5-1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.17.3+~cs2.13.8-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.17.3+~cs2.13.8-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.15.9+~cs1.8.18-1",
        "1.15.9+~cs1.8.18-2",
        "1.16.0+~cs2.12.8-2",
        "1.17.1+~cs2.12.8-1",
        "1.17.2+~cs2.13.8-1",
        "1.17.3+~cs2.13.8-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.20.10+~cs2.13.13-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.20.10+~cs2.13.13-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.18.0+~cs2.13.8-1build1",
        "1.19.2+~cs2.13.13-1build1",
        "1.20.10+~cs2.13.13-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.23.3+~cs1.3.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.23.3+~cs1.3.5-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.22.1+~cs1.3.5-1",
        "1.22.1+~cs1.3.5-1build2",
        "1.22.1+~cs1.3.5-1build3",
        "1.23.3+~cs1.3.5-1"
      ]
    }
  ],
  "aliases": [],
  "details": "node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.",
  "id": "UBUNTU-CVE-2026-71498",
  "modified": "2026-08-13T00:14:08Z",
  "published": "2026-08-06T22:18:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-71498"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71498"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/uhop/node-re2/issues/272"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-71498"
  ]
}