Most recent entries from all

fkie_cve-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

GHSA-j4r3-hg7j-8chg — node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character…

Affected: npm: re2

## Summary

`re2` infers a character's byte length from its UTF-8 lead byte alone, with no bound on the bytes actually remaining in the input. `Buffer` arguments reach the native layer verbatim — only strings are re-encoded into well-formed UTF-8 — so a `Buffer` whose last byte is a multi-byte lead promises continuation bytes that are not there, and the result builders read up to 3 bytes past the end of the buffer. In `replace()` and `split()` those bytes are copied into the returned `Buffer`, disclosing adjacent heap memory to JavaScript. The trigger is deterministic and requires no special heap grooming.

Only `Buffer` input is affected. String input was never at risk: re-encoding guarantees every multi-byte sequence is complete.

## Root cause

`getUtf8CharSize` maps a lead byte to a length of 1–4 and never sees the input size:

```cpp // lib/wrapped_re2.h inline size_t getUtf8CharSize(char ch) { return ((0xE5000000 >> ((ch >> 3) & 0x1E)) & 3) + 1; } ```

Callers then read that many bytes. In the zero-width branch of `replace()`, the guard proves only that at least *one* byte remains:

```cpp // lib/replace.cc else if ((size_t)offset < size) { auto sym_size = getUtf8CharSize(data[offset]); // may claim up to 4 bytes result.append(data + offset, sym_size); // reads data[offset .. offset + 3] byteIndex = offset + sym_size; } ```

`offset < size` permits `offset == size - 1`, so a lead byte of `0xF0` makes `append` read `data[size]`, `data[…

UBUNTU-CVE-2026-71498

Affected: Ubuntu:20.04:LTS: node-re2, Ubuntu:22.04:LTS: node-re2, Ubuntu:24.04:LTS: node-re2, Ubuntu:26.04:LTS: node-re2