https://vulnerability.circl.lu/sightings/feed 2026-08-10T09:02:08.749911+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/23bfd035-e8ef-44dc-815e-940c520d94a0/export 2026-08-10T09:02:08.770166+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "23bfd035-e8ef-44dc-815e-940c520d94a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71430", "type": "seen", "source": "https://gist.github.com/alon710/455dd27ab1381c77c49e252fb102cb9f", "content": "# CVE-2026-71430: CVE-2026-71430: Denial of Service via Native Assertion Failure in node-re2 Replace Operation\n\n> **CVSS Score:** 6.2\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71430\n\n## Summary\nA denial-of-service vulnerability in node-re2 prior to version 1.25.1 allows attackers to trigger uncatchable native assertion failures in the Google V8 engine. By supplying output-amplifying replacement templates, an attacker can exceed V8 string limits, resulting in an immediate process crash.\n\n## TL;DR\nVulnerable versions of node-re2 invoke .ToLocalChecked() on empty V8 handles when string allocations fail due to length limits, crashing the entire Node.js runtime process with SIGABRT.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-617: Reachable Assertion\n- **Attack Vector**: Local (escalatible to Network/Remote under specific application configurations)\n- **CVSS Score**: 6.2 (Medium)\n- **Exploit Status**: Proof of Concept (PoC) verified\n- **Impact**: Denial of Service (DoS) via native process abort\n\n## Affected Systems\n\n- Applications utilizing the 're2' npm package (< 1.25.1) on Node.js runtimes.\n- **re2**: < 1.25.1 (Fixed in: `1.25.1`)\n\n## Mitigation\n\n- Upgrade node-re2 dependency to version 1.25.1 or higher.\n- Restrict max length of user-controlled input strings handled by regex operations.\n- Sanitize or disallow dangerous replace templates containing '$'' or '$`'.\n\n**Remediation Steps:**\n1. Open your project's package.json file.\n2. Locate the 're2' or 'node-re2' dependency and update its version to '^1.25.1'.\n3. Run your package manager install command (e.g., 'npm install' or 'yarn install') to apply the updates.\n4. Execute your regression test suites to verify system integration with the patched binary library.\n\n## References\n\n- [GitHub Security Advisory GHSA-8hcv-x26h-mcgp](https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp)\n- [Fix Commit](https://github.com/uhop/node-re2/commit/5f4e7f9a752e8ef0d1ba7e71f21f7059d0ed0e95)\n- [CVE-2026-71430 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71430)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71430) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T06:34:35.820929Z"} 2026-08-07T06:34:35.820929+00:00 https://vulnerability.circl.lu/sighting/2effcce5-d591-4270-9be8-f6e11fb19b15/export 2026-08-10T09:02:08.772003+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "2effcce5-d591-4270-9be8-f6e11fb19b15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71430", "type": "published-proof-of-concept", "source": "https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp", "content": "", "creation_timestamp": "2026-08-06T22:35:12.262023Z"} 2026-08-06T22:35:12.262023+00:00