Description

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-06T22:18:29.963Z",
  "pubdate": "2026-08-06T22:18:29.963Z",
  "executiveSummary": "A denial of service vulnerability exists in the node-re2 package prior to version 1.25.1. The vulnerability stems from improper handling of V8 string allocation limits within the WrappedRE2::Replace function. When processing global regular expression replacements with output amplifying templates, the resulting string can exceed V8's maximum string length. Because the application fails to validate the MaybeLocal return value before invoking ToLocalChecked, a memory allocation overflow triggers a fatal, uncatchable process abort instead of throwing a catchable JavaScript exception. This impacts Node.js applications utilizing node-re2 for regular expression operations. An unauthenticated attacker can exploit this behavior by supplying crafted inputs that trigger quadratic growth in replacement operations, causing abrupt termination of the Node.js runtime process. The risk is critical for services processing untrusted regular expressions, as it leads to complete service disruption and availability loss without requiring elevated privileges or complex exploitation prerequisites.",
  "technicalDetails": "The vulnerability resides in the WrappedRE2::Replace function of node-re2, affecting versions prior to 1.25.1. The root cause is the unsafe assumption that V8 string allocations will always succeed during the construction of replacement results. Specifically, when a global regular expression replacement operation utilizes an output amplifying replacement template, the memory required to store the resulting string can grow quadratically relative to the size of the input string. As the resulting string or buffer exceeds V8's internal maximum string length constraints, V8 returns an empty MaybeLocal instance to signal the allocation failure. However, the vulnerable codebase passes this result directly to the ToLocalChecked method without performing any conditional checks for the empty MaybeLocal state. In V8 native bindings, invoking ToLocalChecked on an empty handle causes an immediate, fatal process abort that bypasses standard JavaScript try-catch exception handling mechanisms. The attack flow begins when an external actor submits a specifically crafted input payload designed to maximize expansion during a global replace operation. No authentication or specific privilege levels are required to initiate this vector, as long as the application exposes an endpoint or execution path that passes untrusted input to the vulnerable node-re2 replacement interface. Upon processing the payload, the underlying C++ binding triggers the unchecked memory allocation condition, resulting in an immediate crash of the Node.js process and inducing a complete denial of service across the affected service instance."
}