CVE-2026-71498

Received Received - Intake

Out-of-Bounds Read in node-re2 Due to Truncated UTF-8 Sequence

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71498

Affected Vendors & Products

Vendor	Product	Version / Range
node-re2	node-re2	to 1.26.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects node-re2, a Node.js library for RE2 regular expressions. It occurs when a Buffer with a truncated multi-byte UTF-8 sequence is passed, causing the library to read past its allocated memory while decoding the incomplete sequence. This leads to an out-of-bounds read, potentially exposing adjacent memory contents.

Detection Guidance

Detection involves checking the version of node-re2 in use. Run 'npm list re2' or 'npm list node-re2' to verify if the installed version is below 1.26.1. If it is, the system is vulnerable.

Impact Analysis

An attacker could exploit this to read sensitive memory data, potentially leaking confidential information. The impact is limited to information disclosure, as it does not allow code execution or modification of data. Systems using vulnerable versions of node-re2 may be at risk.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations must ensure they are not using vulnerable versions to maintain compliance.

Mitigation Strategies

Update node-re2 to version 1.26.1 or later using 'npm update re2' or 'npm install re2@latest'. If using a package manager, ensure dependencies are updated. Remove any vulnerable versions immediately.

Hi! I’m here to help you understand CVE-2026-71498. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70