CVE-2026-71498: node-re2 Out-of-Bounds Heap Read Vulnerability
Summary
CVE-2026-71498: re2 infers a character's byte length from its UTF-8 lead byte alone, with no bound on the bytes actually remaining in the input. Affects re2 versions < 1.26.1. Fixed in 1.26.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 're2' package is a popular JavaScript library that provides a fast and efficient way to work with regular expressions. It is widely used in Node.js applications for pattern matching and string manipulation. However, a vulnerability has been identified that allows for an out-of-bounds heap read when using Buffer inputs, potentially exposing sensitive adjacent memory to JavaScript.
Vulnerability Detail
The vulnerability arises from the way 're2' infers the byte length of a character from its UTF-8 lead byte without considering the actual size of the input. This can lead to reading beyond the end of a Buffer, resulting in the disclosure of adjacent heap memory. Specifically, functions like 'replace' and 'split' can inadvertently return more bytes than were supplied, including sensitive data from memory. This issue is deterministic and does not require special conditions to exploit, making it a significant risk for applications that handle untrusted input.
How To Fix
Latest published version: 1.27.0 as of 23 Oct 2026
npm install re2@1.27.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.26.1
This is the first release that contains the fix.
npm install re2@1.26.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider using strings instead of Buffers when calling 'replace', 'split', or the 'RE2' constructor. Additionally, you can validate that Buffer input is well-formed UTF-8 before processing it. For example, you can use the following code to check if a Buffer is valid UTF-8:
const isValidUtf8 = (buf) => Buffer.compare(Buffer.from(buf.toString('utf8')), buf) === 0;
if (isValidUtf8(myBuffer)) {
// Safe to use myBuffer
}
Conclusion
The vulnerability CVE-2026-71498 in the 're2' package poses a risk of information disclosure through out-of-bounds heap reads when using Buffer inputs. It is crucial to upgrade to version 1.26.1 or later to mitigate this risk. Additionally, implementing workarounds can help protect applications until an upgrade is feasible.
See every vulnerability recorded for re2 →
FAQ
The CVSS score for this vulnerability is 5.1, indicating a moderate severity level.
Only Buffer inputs are affected. String inputs are not at risk due to re-encoding that ensures well-formed UTF-8.
Yes, it can disclose up to 3 bytes of adjacent heap memory to JavaScript, which may include sensitive information.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
You can implement workarounds such as using strings instead of Buffers or validating Buffer inputs to ensure they are well-formed UTF-8.
References
Related vulnerabilities
Recent vulnerabilities recorded for re2.
