Description

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.1",
  "pubDate": "2026-08-06T22:18:32.207Z",
  "pubdate": "2026-08-06T22:18:32.207Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in node-re2 prior to version 1.26.1.\nThe vulnerability occurs when passing a Buffer containing a truncated multi-byte UTF-8 sequence as the final bytes to the native binding.\nThis flaw allows the native binding to read past the allocated buffer boundary during the decoding of the incomplete code point.\nThe primary impact of this vulnerability is potential information disclosure, allowing an attacker to read adjacent memory contents.\nThe affected product is node-re2 for Node.js, specifically versions prior to 1.26.1.\nAttacker capabilities include extracting sensitive data residing in adjacent memory regions through carefully crafted input buffers.\nNo specific authentication or privileges are explicitly required beyond the ability to supply input data to the vulnerable function within the application.\nRisk implications are moderate to high depending on the sensitivity of the data stored in adjacent memory structures accessible to the Node.js process.",
  "technicalDetails": "The vulnerability resides in the native binding component of the node-re2 package.\nThe root cause is an improper bounds check within the C++ native implementation when processing UTF-8 encoded Buffer objects.\nSpecifically, when a Buffer terminates with a truncated or incomplete multi-byte UTF-8 sequence, the decoding logic attempts to read additional bytes to resolve the final code point.\nBecause the input buffer ends prematurely, the pointer advances past the end of the allocated memory boundary during the read operation.\nThis results in a classic out-of-bounds memory read condition in the native layer.\nThe attack flow begins when an application passes untrusted input containing a malformed or truncated UTF-8 byte sequence to the node-re2 regular expression matching or searching functions.\nUpon execution of the native binding, the decoding routine reads beyond the allocated heap or stack buffer bounds, capturing adjacent memory contents.\nDepending on how the memory is handled subsequently by the application, these leaked memory contents may be returned in error messages, logs, or application responses, leading to information disclosure.\nThe vulnerable component is constrained to versions of node-re2 prior to 1.26.1.\nNo network exposure or authentication requirements are inherent to the vulnerability itself, as it can be triggered locally or via any application pathway that accepts untrusted Buffer inputs into node-re2 methods."
}