{"action":"Upgrade re2 to 1.26.1 or later.","affected":[{"fixed":"1.26.1","introduced":"0"}],"component":"re2","cve_ids":["CVE-2026-71498"],"ecosystem":"npm","epss":0.00174,"exploited":false,"fixed_versions":["1.26.1"],"ghsa_id":"GHSA-j4r3-hg7j-8chg","id":"tcs_01M5KFWY7RXKCNGR9E4GR70KNR","modified_at":"2026-08-06T21:40:58.308038Z","published_at":"2026-08-06T21:26:14Z","references":["https://osv.dev/vulnerability/GHSA-j4r3-hg7j-8chg","https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg","https://github.com/uhop/node-re2/issues/272","https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4","https://github.com/uhop/node-re2"],"severity":{"label":"medium","score":5.1},"sources":[{"source":"osv","source_id":"GHSA-j4r3-hg7j-8chg","url":"https://osv.dev/vulnerability/GHSA-j4r3-hg7j-8chg"}],"summary":"node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript"}