CVE-2026-71498: Out-of-bounds Heap Read in node-re2 via Truncated Multi-byte UTF-8 Characters
Vulnerability ID: CVE-2026-71498
CVSS Score: 5.1
Published: 2026-08-06
A medium-severity out-of-bounds (OOB) heap read vulnerability exists in node-re2 prior to version 1.26.1. When a raw binary Node.js Buffer with a truncated multi-byte UTF-8 character at its end is passed to the C++ native addon, the internal lookahead routine getUtf8CharSize() over-reads up to 3 bytes from the heap, leading to memory disclosure.
TL;DR
Passing a raw Node.js Buffer ending in a truncated multi-byte UTF-8 byte to node-re2 (< 1.26.1) causes a 3-byte heap over-read, leaking adjacent heap memory back to the JavaScript runtime.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-125 (Out-of-bounds Read)
- Attack Vector: Local
- CVSS v3.1: 5.1 (Medium)
- Exploit Status: PoC (Proof-of-Concept) documented
- KEV Status: Not Listed
- Impact Type: Information Disclosure / Memory Leakage
Affected Systems
- node-re2 (npm package: re2) running on Node.js runtime environments
-
re2: < 1.26.1 (Fixed in:
1.26.1)
Code Analysis
Commit: 9d72042
Introduce boundary-aware overload for getUtf8CharSize to check physical limits.
Commit: ee763b8
Update call sites across multiple native source files to pass buffer bounds.
Commit: 411f6b4
Tag release version 1.26.1 containing the security fix.
Exploit Details
- GitHub Issue #272: Demonstration of Buffer with trailing lead byte causing length inflation
Mitigation Strategies
- Upgrade node-re2 (npm package: re2) to version 1.26.1 or later.
- Sanitize Buffer inputs by casting them to standard JS UTF-8 strings before passing them to native RE2 routines.
Remediation Steps:
- Open your project package.json and locate the 're2' dependency entry.
- Update the version identifier to '^1.26.1'.
- Run 'npm update re2' or 'yarn upgrade re2' to obtain the patched binaries.
- Optionally, wrap direct RE2 operations on buffer streams in a defensive validation layer that checks byte arrays for trailing malformed UTF-8 characters.
References
Read the full report for CVE-2026-71498 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)