CVE-2026-67550
1 advisory.
npm/re2 CVE-2026-67550: medium 5.7, EPSS 0.16%
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
Action: Upgrade re2 to 1.25.2 or later.
npm i re2@1.25.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.25.2 | - |
Fixed versions
| 1.25.2 |
Sources
- osv: GHSA-ff84-5f28-78qj
- https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj
- https://nvd.nist.gov/vuln/detail/CVE-2026-67550
- https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d
- https://github.com/uhop/node-re2
- https://github.com/uhop/node-re2/releases/tag/1.25.2
CVE-2026-67550 · published · modified · JSON