{"action":"Upgrade re2 to 1.25.1 or later.","affected":[{"fixed":"1.25.1","introduced":"0"}],"component":"re2","cve_ids":["CVE-2026-71430"],"ecosystem":"npm","epss":0.00157,"exploited":false,"fixed_versions":["1.25.1"],"ghsa_id":"GHSA-8hcv-x26h-mcgp","id":"tcs_01M5KFD2AK8Z3R9XWKG1HVEFYN","modified_at":"2026-08-06T21:40:58.226072Z","published_at":"2026-08-06T21:19:36Z","references":["https://osv.dev/vulnerability/GHSA-8hcv-x26h-mcgp","https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp","https://github.com/uhop/node-re2"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"GHSA-8hcv-x26h-mcgp","url":"https://osv.dev/vulnerability/GHSA-8hcv-x26h-mcgp"}],"summary":"node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length"}