CVE-2026-71498
1 advisory.
npm/re2 CVE-2026-71498: medium 5.1
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
Action: Upgrade re2 to 1.26.1 or later.
npm i re2@1.26.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.26.1 | - |
Fixed versions
| 1.26.1 |
Sources
- osv: GHSA-j4r3-hg7j-8chg
- https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg
- https://github.com/uhop/node-re2/issues/272
- https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4
- https://github.com/uhop/node-re2
CVE-2026-71498 · published · modified · JSON