uhop/node-re2 Security Advisories | GitStock

medium2026-08-06

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

GHSA-j4r3-hg7j-8chg · CVE-2026-71498

medium2026-08-06

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

GHSA-8hcv-x26h-mcgp · CVE-2026-71430

medium2026-07-31

re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

GHSA-ff84-5f28-78qj · CVE-2026-67550

medium2026-07-31

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

GHSA-6hxr-mr5r-9836 · CVE-2026-68499