CVE-2026-71430

Received Received - Intake

Heap Overflow in node-re2 Regular Expression Library

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71430

Affected Vendors & Products

Vendor	Product	Version / Range
node-re2	node-re2	to 1.25.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability affects the node-re2 library, which provides RE2 regular expression bindings for Node.js. The issue is in the WrappedRE2::Replace function, which can cause a process crash when handling large replacement results. Specifically, if a global replace operation uses a replacement template that amplifies output size, the result may grow quadratically with input size. Once the result exceeds V8's maximum string length, an unchecked call to ToLocalChecked causes a fatal process abort instead of a catchable exception.

Detection Guidance

This vulnerability can be detected by checking the version of node-re2 in use. If your system uses node-re2 version 1.25.1 or earlier, it is vulnerable. Run the command 'npm list re2' or 'npm list node-re2' to check the installed version.

Impact Analysis

This vulnerability can cause unexpected crashes in applications using vulnerable versions of node-re2. If an attacker crafts input that triggers the quadratic growth in replacement size, it could lead to denial-of-service conditions by terminating the Node.js process. This may disrupt services relying on the affected library.

Mitigation Strategies

Immediately update node-re2 to version 1.25.1 or later using the command 'npm update re2' or 'npm install re2@latest'. If updating is not possible, consider removing or disabling the package until the update can be applied.

Hi! I’m here to help you understand CVE-2026-71430. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70