CVE-2026-71498

Name of the Vulnerable Software and Affected Versions node-re2 versions prior to 1.26.1

Description An out-of-bounds read exists when passing a Buffer whose final bytes form a truncated multi-byte UTF-8 sequence. The native binding fails to validate the remaining buffer size when decoding the final code point, potentially reading up to 3 bytes past the end of the allocated buffer. This occurs because the getUtf8CharSize() function infers character length from the lead byte without checking the actual remaining bytes.

This issue can lead to the disclosure of adjacent heap memory contents when using the replace() and split() functions. Additionally, while pattern compilation via the RE2 constructor may trigger an out-of-bounds read, it does not result in memory disclosure as the malformed input is rejected. Only Buffer input is affected; string input is not at risk as it is re-encoded into well-formed UTF-8.

Recommendations Update node-re2 to version 1.26.1 or later. As a temporary workaround, pass strings instead of Buffer objects, or validate that Buffer input is well-formed UTF-8 before calling replace(), split(), or the RE2 constructor.