EUVD-2026-51297
GHSA-ff84-5f28-78qj
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Network vector reflects typical server-side Node.js deployment; high complexity captures the UTF-16/UTF-8 gap condition; no privileges needed for a public endpoint.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 40 npm packages depend on re2 (4 direct, 37 indirect)
Ecosystem-wide dependent count for version 1.25.2.
DescriptionCVE.org
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
AnalysisAI
Out-of-bounds heap read in node-re2 prior to 1.25.2 allows process termination and limited heap memory disclosure when an attacker-influenced lastIndex value is used against a non-ASCII subject string. The flaw arises because lastIndex is validated against the UTF-8 byte length of the input but consumed as a UTF-16 code-unit offset - for any non-ASCII character, the UTF-8 byte count exceeds the UTF-16 unit count, creating a gap where a lastIndex passes the guard yet reads past the allocated buffer. The resulting crash is uncatchable by the Node.js process, making it an effective denial-of-service vector in any server application exposing this code path to external input. No active exploitation confirmed (not in CISA KEV); no public exploit code identified at time of analysis.
Technical ContextAI
node-re2 (CPE: cpe:2.3:a:uhop:node-re2:*:*:*:*:*:*:*:*) wraps Google's RE2 C++ regex engine for use in Node.js via V8/NAN bindings. V8 stores JavaScript strings internally as UTF-16; RE2 operates on UTF-8 bytes. The addon layer must translate between these representations, tracking code-unit offsets for the sticky/global lastIndex property. The root cause (CWE-125: Out-of-bounds Read) is in prepareArgument() in addon.cc: the pre-patch code computed argLength via utf8Length(), which walks UTF-8 bytes (O(n)), and used that count to bound lastIndex. For a string like 'éé' (2 UTF-16 units, 4 UTF-8 bytes), a lastIndex of 3 passes the byte-length guard but is out of range for the UTF-16 buffer. The fix (commit 56293de) redefines argLength as s->Length() - the O(1) UTF-16 unit count - ensuring the guard is always consistent with the offset domain actually used. The getUtf16PositionByCounter helper also received a size parameter and a from > size clamp to prevent the walker from running off the end independently.
RemediationAI
Upgrade node-re2 to version 1.25.2 or later; this is the vendor-released patch confirming the fix (https://github.com/uhop/node-re2/releases/tag/1.25.2). The underlying code change is in the C++ addon layer and cannot be patched at the JavaScript application level without recompiling the native module. If an immediate upgrade is not possible, the most effective compensating control is to sanitize or reject non-ASCII input before passing it to any RE2 method when using sticky ('y') or global ('g') flags - this eliminates the UTF-16/UTF-8 length discrepancy that creates the exploitable gap. Alternatively, avoid explicitly setting lastIndex on RE2 objects from external data and avoid iterating RE2 global/sticky regexes over user-supplied strings until the patch is applied. Note that input sanitization adds latency and may alter application semantics for internationalized content. The fix commit is at https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today