Vulnerability-Lookup

CVE-2026-67550 (GCVE-0-2026-67550)

Vulnerability from cvelistv5 – Published: 2026-07-30 19:59 – Updated: 2026-07-31 23:07

Title

re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

Summary

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/uhop/node-re2/security/advisor…	x_refsource_CONFIRM
https://github.com/uhop/node-re2/commit/56293de4f…	x_refsource_MISC
https://github.com/uhop/node-re2/releases/tag/1.25.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
uhop	node-re2	Affected: < 1.25.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67550",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T23:06:52.923503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T23:07:18.352Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-re2",
          "vendor": "uhop",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.25.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "re2 provides Node.js bindings for Google\u0027s RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T19:59:55.916Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj"
        },
        {
          "name": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d"
        },
        {
          "name": "https://github.com/uhop/node-re2/releases/tag/1.25.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/uhop/node-re2/releases/tag/1.25.2"
        }
      ],
      "source": {
        "advisory": "GHSA-ff84-5f28-78qj",
        "discovery": "UNKNOWN"
      },
      "title": "re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject \u2192 uncatchable process crash (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-67550",
    "datePublished": "2026-07-30T19:59:55.916Z",
    "dateReserved": "2026-07-29T18:47:17.075Z",
    "dateUpdated": "2026-07-31T23:07:18.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-67550",
      "date": "2026-07-31",
      "epss": "0.00121",
      "percentile": "0.02211"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-67550\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-30T20:18:15.030\",\"lastModified\":\"2026-07-30T20:18:15.030\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"re2 provides Node.js bindings for Google\u0027s RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"uhop\",\"product\":\"node-re2\",\"versions\":[{\"version\":\"\u003c 1.25.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.4,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/uhop/node-re2/releases/tag/1.25.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject \\u2192 uncatchable process crash (DoS)\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-125\", \"lang\": \"en\", \"description\": \"CWE-125: Out-of-bounds Read\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 5.7, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj\"}, {\"name\": \"https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d\"}, {\"name\": \"https://github.com/uhop/node-re2/releases/tag/1.25.2\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/uhop/node-re2/releases/tag/1.25.2\"}], \"affected\": [{\"vendor\": \"uhop\", \"product\": \"node-re2\", \"versions\": [{\"version\": \"\u003c 1.25.2\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-30T19:59:55.916Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"re2 provides Node.js bindings for Google\u0027s RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.\"}], \"source\": {\"advisory\": \"GHSA-ff84-5f28-78qj\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-67550\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-31T23:06:52.923503Z\"}}}], \"references\": [{\"url\": \"https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-31T23:07:14.086Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-67550\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-07-29T18:47:17.075Z\", \"datePublished\": \"2026-07-30T19:59:55.916Z\", \"dateUpdated\": \"2026-07-31T23:07:18.352Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-FF84-5F28-78QJ

Vulnerability from github – Published: 2026-07-31 16:53 – Updated: 2026-07-31 16:53

Summary

re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

Details

Summary

re2 validates the user-settable lastIndex against the subject's UTF-8 byte length but then uses it as a UTF-16 code-unit count to walk the subject buffer, with no bounds check. For any non-ASCII subject, the byte length is larger than the true character count, so a lastIndex between those two values passes validation while pointing past the end of the buffer. The subsequent walk reads out of bounds. With a large subject the read marches into unmapped memory and the process dies with SIGABRT/SIGSEGV — an uncatchable crash (try/catch cannot stop it), i.e. a denial of service for any worker/process that runs the match. In some cases the out-of-bounds bytes are copied into the returned value (a bounded, best-effort heap information leak).

Root cause

The subject wrapper stores the UTF-8 byte length in StrVal::length:

lib/addon.cc:200 auto argLength = utf8Length(s, isolate); — UTF-8 byte count
lib/addon.cc:209 lastStringValue.reset(buffer, argSize, argLength, startFrom, false, isAscii);

setIndex then validates the (UTF-16) lastIndex against that byte length and walks the buffer by character count:

// lib/addon.cc:229
void StrVal::setIndex(size_t newIndex) {
    isValidIndex = newIndex <= length;   // length == UTF-8 BYTE length, not UTF-16 length
    if (!isValidIndex) { index = newIndex; byteIndex = 0; return; }
    ...
    // addon.cc:263
    byteIndex = index < newIndex
        ? getUtf16PositionByCounter(data, byteIndex, newIndex - index)
        : getUtf16PositionByCounter(data, 0, newIndex);
    index = newIndex;
}

getUtf16PositionByCounter reads data[from] and advances by the UTF-8 char size with no check of from against the buffer size:

// lib/wrapped_re2.h:264
inline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n) {
    for (; n > 0; --n) {
        size_t s = getUtf8CharSize(data[from]);   // <-- OOB read once `from` passes the buffer end
        from += s;
        if (s == 4 && n >= 2) --n;
    }
    return from;
}

lastIndex is user-settable to any positive integer (capped only at >= 0, no upper bound):

// lib/accessors.cc:166
NAN_SETTER(WrappedRE2::SetLastIndex) {
    ...
    int n = value->NumberValue(...).FromMaybe(0);
    re2->lastIndex = n <= 0 ? 0 : n;   // no upper bound relative to the subject
}

For an ASCII subject the byte length equals the UTF-16 length, so the guard is correct — this only triggers on non-ASCII subjects. The out-of-bounds read happens inside prepareArgument for any global/sticky regex, reached by exec, test, String.prototype.match, replace, and split.

Proof of concept

Minimal (AddressSanitizer, deterministic OOB read):

const RE2 = require('re2');
const re = new RE2('a', 'y');   // sticky; 'g' also works
re.lastIndex = 3;               // 3 <= byteLen(4) passes the guard; only 2 real chars exist
re.exec('éé');                  // U+00E9 = 2 bytes each

Built with -fsanitize=address, this aborts with:

ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1
  #0 getUtf16PositionByCounter   wrapped_re2.h:268
  #1 StrVal::reset               addon.cc:277
  #2 WrappedRE2::prepareArgument addon.cc:209
  #3 WrappedRE2::Exec            exec.cc:17

The overflowed region is the subject buffer allocated by node::Buffer::New at addon.cc:205.

Real-world impact on the shipped prebuilt binary (no ASAN) — uncatchable crash:

const RE2 = require('re2');
const s = '中'.repeat(40000000);        // UTF-16 length 40M, UTF-8 bytes 120M
const re = new RE2('a', 'y');
re.lastIndex = Buffer.byteLength(s) - 1; // passes the byte-length guard, far exceeds real char count
re.exec(s);                              // walks into unmapped memory -> SIGSEGV (exit 139)

try { ... } catch (e) {} around the call does not prevent termination — it is a native fault, not a JS exception. Validated on a clean npm install re2@1.25.1 (latest): stock prebuilt → SIGSEGV; ASAN build → the heap-buffer-overflow read above.

Impact

Denial of service (primary): an uncatchable native crash that terminates the Node process/worker. Reachable remotely and without authentication wherever an application (a) uses a global or sticky RE2, (b) applies it to a non-ASCII subject, and (c) sets lastIndex from attacker-influenced data (e.g. resuming a scan/pagination at a client-supplied offset).
Information disclosure (secondary, best-effort): the out-of-bounds byteIndex can cause adjacent heap bytes to be copied into the returned value (e.g. the leading segment of a replace result). This is bounded and unreliable — the subject buffer is calloc-allocated (zero-filled) and the over-read distance depends on interpreting out-of-bounds bytes as UTF-8 sizes — so it is noted for completeness, not as a dependable primitive.

This is distinct from GHSA-8hcv-x26h-mcgp (the global replace() output-amplification abort), which was fixed in 1.25.1. This lastIndex out-of-bounds read is a separate defect and remains present in 1.25.1.

Suggested fix

Two independent hardenings; either closes the crash, both is safest:

Bound the walk so it can never read past the buffer:

inline size_t getUtf16PositionByCounter(const char *data, size_t size, size_t from, size_t n) {
    for (; n > 0 && from < size; --n) {
        size_t s = getUtf8CharSize(data[from]);
        from += s;
        if (s == 4 && n >= 2) --n;
    }
    return from > size ? size : from;
}

(thread size through the two call sites in StrVal::setIndex).

Validate lastIndex against the true UTF-16 length, not the UTF-8 byte length — e.g. store s->Length() (UTF-16 units) as the value compared in isValidIndex = newIndex <= <utf16Length>, so an out-of-range lastIndex takes the existing !isValidIndex early-return path.

Resolution

Fixed in re2 1.25.2.

lastIndex is now validated against the subject's UTF-16 length instead of its UTF-8 byte length (lib/addon.cc), so an out-of-range lastIndex is rejected before the buffer is walked. As defense in depth, the code-unit walk (getUtf16PositionByCounter in lib/wrapped_re2.h) is now bounded by the buffer size and can no longer read past the end.

Remediation: upgrade to re2@1.25.2 or later.

Workaround (if you cannot upgrade): do not assign lastIndex from untrusted input, or clamp it to the subject's string length (str.length) before calling exec/test/match/replace/split on a non-ASCII subject.

Severity

5.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.25.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "re2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-67550"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T16:53:16Z",
    "nvd_published_at": "2026-07-30T20:18:15Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`re2` validates the user-settable `lastIndex` against the subject\u0027s **UTF-8 byte length** but then uses it as a **UTF-16 code-unit count** to walk the subject buffer, with no bounds check. For any non-ASCII subject, the byte length is larger than the true character count, so a `lastIndex` between those two values passes validation while pointing past the end of the buffer. The subsequent walk reads out of bounds. With a large subject the read marches into unmapped memory and the process dies with **SIGABRT/SIGSEGV** \u2014 an uncatchable crash (`try/catch` cannot stop it), i.e. a denial of service for any worker/process that runs the match. In some cases the out-of-bounds bytes are copied into the returned value (a bounded, best-effort heap information leak).\n\n## Root cause\n\nThe subject wrapper stores the UTF-8 **byte** length in `StrVal::length`:\n\n- `lib/addon.cc:200` `auto argLength = utf8Length(s, isolate);` \u2014 UTF-8 **byte** count\n- `lib/addon.cc:209` `lastStringValue.reset(buffer, argSize, argLength, startFrom, false, isAscii);`\n\n`setIndex` then validates the (UTF-16) `lastIndex` against that byte length and walks the buffer by character count:\n\n```cpp\n// lib/addon.cc:229\nvoid StrVal::setIndex(size_t newIndex) {\n    isValidIndex = newIndex \u003c= length;   // length == UTF-8 BYTE length, not UTF-16 length\n    if (!isValidIndex) { index = newIndex; byteIndex = 0; return; }\n    ...\n    // addon.cc:263\n    byteIndex = index \u003c newIndex\n        ? getUtf16PositionByCounter(data, byteIndex, newIndex - index)\n        : getUtf16PositionByCounter(data, 0, newIndex);\n    index = newIndex;\n}\n```\n\n`getUtf16PositionByCounter` reads `data[from]` and advances by the UTF-8 char size with **no check of `from` against the buffer size**:\n\n```cpp\n// lib/wrapped_re2.h:264\ninline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n) {\n    for (; n \u003e 0; --n) {\n        size_t s = getUtf8CharSize(data[from]);   // \u003c-- OOB read once `from` passes the buffer end\n        from += s;\n        if (s == 4 \u0026\u0026 n \u003e= 2) --n;\n    }\n    return from;\n}\n```\n\n`lastIndex` is user-settable to any positive integer (capped only at `\u003e= 0`, no upper bound):\n\n```cpp\n// lib/accessors.cc:166\nNAN_SETTER(WrappedRE2::SetLastIndex) {\n    ...\n    int n = value-\u003eNumberValue(...).FromMaybe(0);\n    re2-\u003elastIndex = n \u003c= 0 ? 0 : n;   // no upper bound relative to the subject\n}\n```\n\nFor an ASCII subject the byte length equals the UTF-16 length, so the guard is correct \u2014 this only triggers on non-ASCII subjects. The out-of-bounds read happens inside `prepareArgument` for any `global`/`sticky` regex, reached by `exec`, `test`, `String.prototype.match`, `replace`, and `split`.\n\n## Proof of concept\n\n**Minimal (AddressSanitizer, deterministic OOB read):**\n\n```js\nconst RE2 = require(\u0027re2\u0027);\nconst re = new RE2(\u0027a\u0027, \u0027y\u0027);   // sticky; \u0027g\u0027 also works\nre.lastIndex = 3;               // 3 \u003c= byteLen(4) passes the guard; only 2 real chars exist\nre.exec(\u0027\u00e9\u00e9\u0027);                  // U+00E9 = 2 bytes each\n```\n\nBuilt with `-fsanitize=address`, this aborts with:\n\n```\nERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1\n  #0 getUtf16PositionByCounter   wrapped_re2.h:268\n  #1 StrVal::reset               addon.cc:277\n  #2 WrappedRE2::prepareArgument addon.cc:209\n  #3 WrappedRE2::Exec            exec.cc:17\n```\n\nThe overflowed region is the subject buffer allocated by `node::Buffer::New` at `addon.cc:205`.\n\n**Real-world impact on the shipped prebuilt binary (no ASAN) \u2014 uncatchable crash:**\n\n```js\nconst RE2 = require(\u0027re2\u0027);\nconst s = \u0027\u4e2d\u0027.repeat(40000000);        // UTF-16 length 40M, UTF-8 bytes 120M\nconst re = new RE2(\u0027a\u0027, \u0027y\u0027);\nre.lastIndex = Buffer.byteLength(s) - 1; // passes the byte-length guard, far exceeds real char count\nre.exec(s);                              // walks into unmapped memory -\u003e SIGSEGV (exit 139)\n```\n\n`try { ... } catch (e) {}` around the call does **not** prevent termination \u2014 it is a native fault, not a JS exception. Validated on a clean `npm install re2@1.25.1` (latest): stock prebuilt \u2192 SIGSEGV; ASAN build \u2192 the heap-buffer-overflow read above.\n\n## Impact\n\n- **Denial of service (primary):** an uncatchable native crash that terminates the Node process/worker. Reachable remotely and without authentication wherever an application (a) uses a `global` or `sticky` `RE2`, (b) applies it to a non-ASCII subject, and (c) sets `lastIndex` from attacker-influenced data (e.g. resuming a scan/pagination at a client-supplied offset).\n- **Information disclosure (secondary, best-effort):** the out-of-bounds `byteIndex` can cause adjacent heap bytes to be copied into the returned value (e.g. the leading segment of a `replace` result). This is bounded and unreliable \u2014 the subject buffer is `calloc`-allocated (zero-filled) and the over-read distance depends on interpreting out-of-bounds bytes as UTF-8 sizes \u2014 so it is noted for completeness, not as a dependable primitive.\n\nThis is distinct from GHSA-8hcv-x26h-mcgp (the global `replace()` output-amplification abort), which was fixed in 1.25.1. This `lastIndex` out-of-bounds read is a separate defect and remains present in 1.25.1.\n\n## Suggested fix\n\nTwo independent hardenings; either closes the crash, both is safest:\n\n1. **Bound the walk** so it can never read past the buffer:\n\n```cpp\ninline size_t getUtf16PositionByCounter(const char *data, size_t size, size_t from, size_t n) {\n    for (; n \u003e 0 \u0026\u0026 from \u003c size; --n) {\n        size_t s = getUtf8CharSize(data[from]);\n        from += s;\n        if (s == 4 \u0026\u0026 n \u003e= 2) --n;\n    }\n    return from \u003e size ? size : from;\n}\n```\n(thread `size` through the two call sites in `StrVal::setIndex`).\n\n2. **Validate `lastIndex` against the true UTF-16 length**, not the UTF-8 byte length \u2014 e.g. store `s-\u003eLength()` (UTF-16 units) as the value compared in `isValidIndex = newIndex \u003c= \u003cutf16Length\u003e`, so an out-of-range `lastIndex` takes the existing `!isValidIndex` early-return path.\n\n## Resolution\n\nFixed in re2 1.25.2.\n\n`lastIndex` is now validated against the subject\u0027s UTF-16 length instead of its\nUTF-8 byte length (`lib/addon.cc`), so an out-of-range `lastIndex` is rejected\nbefore the buffer is walked. As defense in depth, the code-unit walk\n(`getUtf16PositionByCounter` in `lib/wrapped_re2.h`) is now bounded by the\nbuffer size and can no longer read past the end.\n\n**Remediation:** upgrade to `re2@1.25.2` or later.\n\n**Workaround** (if you cannot upgrade): do not assign `lastIndex` from untrusted\ninput, or clamp it to the subject\u0027s string length (`str.length`) before calling\n`exec`/`test`/`match`/`replace`/`split` on a non-ASCII subject.",
  "id": "GHSA-ff84-5f28-78qj",
  "modified": "2026-07-31T16:53:16Z",
  "published": "2026-07-31T16:53:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67550"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/uhop/node-re2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uhop/node-re2/releases/tag/1.25.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject \u2192 uncatchable process crash (DoS)"
}

ubuntu-cve-2026-67550

Vulnerability from osv_ubuntu

Published

2026-07-31 00:00

Modified

2026-07-31 00:00

Summary

Details

(re2 provides Node.js bindings for Google's RE2 regular expression engi ...)

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-67550	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-67550	REPORT
	https://github.com/uhop/node-re2/security/advisor…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.10.5-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.10.5-1build1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.4-1",
        "1.10.5-1",
        "1.10.5-1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.17.3+~cs2.13.8-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.17.3+~cs2.13.8-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.15.9+~cs1.8.18-1",
        "1.15.9+~cs1.8.18-2",
        "1.16.0+~cs2.12.8-2",
        "1.17.1+~cs2.12.8-1",
        "1.17.2+~cs2.13.8-1",
        "1.17.3+~cs2.13.8-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.20.10+~cs2.13.13-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.20.10+~cs2.13.13-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.18.0+~cs2.13.8-1build1",
        "1.19.2+~cs2.13.13-1build1",
        "1.20.10+~cs2.13.13-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-re2",
            "binary_version": "1.23.3+~cs1.3.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-re2",
        "purl": "pkg:deb/ubuntu/node-re2@1.23.3+~cs1.3.5-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.22.1+~cs1.3.5-1",
        "1.22.1+~cs1.3.5-1build2",
        "1.22.1+~cs1.3.5-1build3",
        "1.23.3+~cs1.3.5-1"
      ]
    }
  ],
  "aliases": [],
  "details": "(re2 provides Node.js bindings for Google\u0026#x27;s RE2 regular expression engi ...)",
  "id": "UBUNTU-CVE-2026-67550",
  "modified": "2026-07-31T00:00:00Z",
  "published": "2026-07-31T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-67550"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67550"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-67550"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-67550 (GCVE-0-2026-67550)

GHSA-FF84-5F28-78QJ

Summary

Root cause

Proof of concept

Impact

Suggested fix

Resolution

ubuntu-cve-2026-67550

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature