CVE-2026-71430: Denial of Service via Native Assertion Failure in node-re2 Replace Operation
Vulnerability ID: CVE-2026-71430
CVSS Score: 6.2
Published: 2026-08-06
A denial-of-service vulnerability in node-re2 prior to version 1.25.1 allows attackers to trigger uncatchable native assertion failures in the Google V8 engine. By supplying output-amplifying replacement templates, an attacker can exceed V8 string limits, resulting in an immediate process crash.
TL;DR
Vulnerable versions of node-re2 invoke .ToLocalChecked() on empty V8 handles when string allocations fail due to length limits, crashing the entire Node.js runtime process with SIGABRT.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-617: Reachable Assertion
- Attack Vector: Local (escalatible to Network/Remote under specific application configurations)
- CVSS Score: 6.2 (Medium)
- Exploit Status: Proof of Concept (PoC) verified
- Impact: Denial of Service (DoS) via native process abort
Affected Systems
- Applications utilizing the 're2' npm package (< 1.25.1) on Node.js runtimes.
-
re2: < 1.25.1 (Fixed in:
1.25.1)
Code Analysis
Commit: 5f4e7f9
Fix: added checks to handle memory allocation issues
--- a/lib/replace.cc
+++ b/lib/replace.cc
Mitigation Strategies
- Upgrade node-re2 dependency to version 1.25.1 or higher.
- Restrict max length of user-controlled input strings handled by regex operations.
- Sanitize or disallow dangerous replace templates containing '$'' or '$`'.
Remediation Steps:
- Open your project's package.json file.
- Locate the 're2' or 'node-re2' dependency and update its version to '^1.25.1'.
- Run your package manager install command (e.g., 'npm install' or 'yarn install') to apply the updates.
- Execute your regression test suites to verify system integration with the patched binary library.
References
Read the full report for CVE-2026-71430 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)