CVE-2026-71430: node-re2 Denial of Service via String.prototype.replace with Large Output
Summary
CVE-2026-71430: Description WrappedRE2::Replace builds the replacement result and hands it to V8 with .ToLocalChecked() without checking for the empty MaybeLocal that V8 returns when the string/buffer exceeds its maximum length: lib/rep... Affects re2 versions < 1.25.1. Fixed in 1.25.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 're2' package is a Node.js binding for the RE2 regular expression library, designed for safe and efficient regex processing. It is particularly favored for its ability to handle untrusted patterns and inputs without the risk of catastrophic backtracking. However, a critical vulnerability has been identified that can lead to a denial of service when using the String.prototype.replace method with certain templates.
Vulnerability Detail
The vulnerability arises from the 'WrappedRE2::Replace' function, which fails to check for an empty 'MaybeLocal' return value from V8 when the result string exceeds the maximum allowable length. This oversight leads to an uncaught process abort (SIGABRT) instead of a catchable JavaScript exception. Specifically, when using a global replace with an output-amplifying template, the resulting string can grow to an unmanageable size, causing the Node process to terminate unexpectedly. This behavior diverges from the built-in regex engine, which correctly throws a catchable RangeError for the same scenario.
How To Fix
Latest published version: 1.27.0 as of 23 Oct 2026
npm install re2@1.27.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.25.1
This is the first release that contains the fix.
npm install re2@1.25.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using output-amplifying templates like '$'' or '$`' in your regex replacements, especially with large input strings. For example, instead of using:
'a'.
repeat(50000).replace(new RE2('a', 'g'), "$'");
consider using a different approach that does not amplify the output size.
Conclusion
The vulnerability CVE-2026-71430 in the 're2' package poses a significant risk of denial of service due to uncaught process aborts. It is crucial for developers to update to version 1.25.1 or later to mitigate this risk. Additionally, employing Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for re2 →
FAQ
CVE-2026-71430 is a vulnerability in the 're2' package that can cause a denial of service by aborting the Node process when using String.prototype.replace with certain templates.
If your application uses the 're2' package and processes user input with the vulnerable String.prototype.replace method, it could be susceptible to crashes, leading to service downtime.
If an immediate upgrade is not possible, avoid using output-amplifying templates in your regex replacements to mitigate the risk of triggering the vulnerability.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time without requiring code access or installation.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for re2.
