{"uuid": "649f66a2-2c4c-4644-bba0-d0e86e9fa228", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8hcv-x26h-mcgp", "type": "seen", "source": "https://gist.github.com/alon710/455dd27ab1381c77c49e252fb102cb9f", "content": "# CVE-2026-71430: CVE-2026-71430: Denial of Service via Native Assertion Failure in node-re2 Replace Operation\n\n> **CVSS Score:** 6.2\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71430\n\n## Summary\nA denial-of-service vulnerability in node-re2 prior to version 1.25.1 allows attackers to trigger uncatchable native assertion failures in the Google V8 engine. By supplying output-amplifying replacement templates, an attacker can exceed V8 string limits, resulting in an immediate process crash.\n\n## TL;DR\nVulnerable versions of node-re2 invoke .ToLocalChecked() on empty V8 handles when string allocations fail due to length limits, crashing the entire Node.js runtime process with SIGABRT.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-617: Reachable Assertion\n- **Attack Vector**: Local (escalatible to Network/Remote under specific application configurations)\n- **CVSS Score**: 6.2 (Medium)\n- **Exploit Status**: Proof of Concept (PoC) verified\n- **Impact**: Denial of Service (DoS) via native process abort\n\n## Affected Systems\n\n- Applications utilizing the 're2' npm package (< 1.25.1) on Node.js runtimes.\n- **re2**: < 1.25.1 (Fixed in: `1.25.1`)\n\n## Mitigation\n\n- Upgrade node-re2 dependency to version 1.25.1 or higher.\n- Restrict max length of user-controlled input strings handled by regex operations.\n- Sanitize or disallow dangerous replace templates containing '$'' or '$`'.\n\n**Remediation Steps:**\n1. Open your project's package.json file.\n2. Locate the 're2' or 'node-re2' dependency and update its version to '^1.25.1'.\n3. Run your package manager install command (e.g., 'npm install' or 'yarn install') to apply the updates.\n4. Execute your regression test suites to verify system integration with the patched binary library.\n\n## References\n\n- [GitHub Security Advisory GHSA-8hcv-x26h-mcgp](https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp)\n- [Fix Commit](https://github.com/uhop/node-re2/commit/5f4e7f9a752e8ef0d1ba7e71f21f7059d0ed0e95)\n- [CVE-2026-71430 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71430)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71430) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T06:34:35.772592Z"}