Out-of-Bounds Read in re2 Node.js Bindings

Executive Summary

This vulnerability affects the re2 library which provides Node.js bindings for Google's RE2 regular expression engine. The issue occurs because the library validates the lastIndex property against the UTF-8 byte length of a subject string but then uses it as a UTF-16 code-unit offset when performing operations like exec, test, match, replace, and split. This mismatch can lead to an out-of-bounds heap read and cause an uncatchable process crash. The vulnerability is fixed in version 1.25.2.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires checking the version of the re2 library in use. Run 'npm list re2' or 'npm list -g re2' to check the installed version. If it is below 1.25.2, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this vulnerability by influencing the lastIndex value on a non-ASCII subject string, potentially causing a crash of the Node.js process. In some cases, this might also lead to limited disclosure of heap information. The impact is primarily on the stability and availability of applications using vulnerable versions of the re2 library.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by causing uncatchable process crashes, leading to service disruptions and potential data processing interruptions. The out-of-bounds heap read may expose limited heap information, which could risk unauthorized data access if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update the re2 library to version 1.25.2 or later using 'npm update re2' or by specifying the version in your package.json. Restart any affected applications after updating.

Useful 0 Not Useful 0