Node.js RE2 Regular Expression Bindings Vulnerability in Uhop
CVE-2026-71430

6.2MEDIUM

Key Information:

Vendor

Uhop

Status
Node-re2
Vendor
CVE Published:
6 August 2026

What is CVE-2026-71430?

The node-re2 library, which enables RE2 regular expression support for Node.js, contains a vulnerability that can lead to a fatal process abort when handling specific replacement operations. The WrappedRE2::Replace function fails to verify the output string's length before passing it to V8's engine. When the resultant string from a global replace grows significantly, this unchecked operation can exceed V8's maximum allowable string length, resulting in a non-recoverable application crash. It is recommended that users upgrade to version 1.25.1 or later to mitigate this risk.

Affected Version(s)

node-re2 < 1.25.1

References

https://github.com/uhop/node-re2/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.