Buffer Vulnerability in Node.js RE2 Regular Expression Bindings

CVE-2026-71498

What is CVE-2026-71498?

The node-re2 library, which provides RE2 regular expression bindings for Node.js, has a vulnerability related to improper handling of UTF-8 sequences. Specifically, versions prior to 1.26.1 fail to correctly process a Buffer that contains a truncated multi-byte UTF-8 sequence. This oversight may allow the native binding to read beyond the boundary of the allocated buffer, leading to an out-of-bounds read and exposing potentially sensitive information stored in adjacent memory. Users are advised to upgrade to version 1.26.1 or later to mitigate this risk.

References