Out-of-Bounds Heap Read Vulnerability in re2 Node.js Bindings

CVE-2026-67550

What is CVE-2026-67550?

The re2 library, which provides Node.js bindings for Google's efficient RE2 regular expression engine, is susceptible to an out-of-bounds heap read vulnerability. This issue arises when the library processes a non-ASCII subject. While it accurately verifies the lastIndex against the UTF-8 byte length, it incorrectly interprets this value as a UTF-16 code-unit offset during various operations (exec, test, match, replace, and split). An attacker may exploit this flaw to manipulate the lastIndex, potentially leading to an uncatchable process crash and exposing limited heap information. The problem has been addressed and fixed in version 1.25.2.

References