Node Re2
Monthly
node-re2, the Node.js native binding for Google's RE2 regular expression engine, enters an infinite loop and leaks unbounded native memory when String.prototype.match is called with a global pattern capable of producing zero-width (empty string) matches. All versions prior to 1.25.2 are affected; because RE2 executes synchronously within the Node.js event loop thread, the hang is unrecoverable without a process restart, making any service that exposes RE2 global matching to externally-supplied input susceptible to complete denial of service. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trigger condition is mechanically trivial and directly exercisable from patterns confirmed in the vendor's own test additions.
Out-of-bounds heap read in node-re2 prior to 1.25.2 allows process termination and limited heap memory disclosure when an attacker-influenced lastIndex value is used against a non-ASCII subject string. The flaw arises because lastIndex is validated against the UTF-8 byte length of the input but consumed as a UTF-16 code-unit offset - for any non-ASCII character, the UTF-8 byte count exceeds the UTF-16 unit count, creating a gap where a lastIndex passes the guard yet reads past the allocated buffer. The resulting crash is uncatchable by the Node.js process, making it an effective denial-of-service vector in any server application exposing this code path to external input. No active exploitation confirmed (not in CISA KEV); no public exploit code identified at time of analysis.
node-re2, the Node.js native binding for Google's RE2 regular expression engine, enters an infinite loop and leaks unbounded native memory when String.prototype.match is called with a global pattern capable of producing zero-width (empty string) matches. All versions prior to 1.25.2 are affected; because RE2 executes synchronously within the Node.js event loop thread, the hang is unrecoverable without a process restart, making any service that exposes RE2 global matching to externally-supplied input susceptible to complete denial of service. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trigger condition is mechanically trivial and directly exercisable from patterns confirmed in the vendor's own test additions.
Out-of-bounds heap read in node-re2 prior to 1.25.2 allows process termination and limited heap memory disclosure when an attacker-influenced lastIndex value is used against a non-ASCII subject string. The flaw arises because lastIndex is validated against the UTF-8 byte length of the input but consumed as a UTF-16 code-unit offset - for any non-ASCII character, the UTF-8 byte count exceeds the UTF-16 unit count, creating a gap where a lastIndex passes the guard yet reads past the allocated buffer. The resulting crash is uncatchable by the Node.js process, making it an effective denial-of-service vector in any server application exposing this code path to external input. No active exploitation confirmed (not in CISA KEV); no public exploit code identified at time of analysis.