Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-71498: node-re2 may expose nearby memory when handling broken text

CVE-2026-71498 · published 3 months ago

Summary

The node-re2 library used in several Debian and other Linux packages can accidentally read data from memory next to a buffer if it receives text that ends with an incomplete multi‑byte character. This could let a program see information it should not see. Updating node-re2 to version 1.26.1 or later fixes the problem.

What to do

Update elazutkin re2 to version 1.26.1.
Update debian node-re2 to version 1.26.1+~cs1.7.0-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	node-re2	All versions
Debian:12	debian	node-re2	All versions
Debian:13	debian	node-re2	All versions
Debian:14	debian	node-re2	< 1.26.1+~cs1.7.0-1 Fix: upgrade to 1.26.1+~cs1.7.0-1
npm	elazutkin	re2	<= 1.26.0 Fix: upgrade to 1.26.1
–	uhop	node-re2	< 1.26.1
Ubuntu:20.04:LTS	canonical	node-re2	All versions

Original advisory text

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

References

https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg Vendor Advisory
https://github.com/uhop/node-re2/issues/272 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-71498 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71498... Vendor Advisory
https://github.com/advisories/GHSA-j4r3-hg7j-8chg
https://nvd.nist.gov/vuln/detail/CVE-2026-71498 Vendor Advisory
https://ubuntu.com/security/CVE-2026-71498 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-71498 Third Party Advisory
https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published6 Aug 2026

Updated26 Oct 2026

First seen6 Aug 2026

Sources

DEBIAN-CVE-2026-71498 · OSV

GHSA-j4r3-hg7j-8chg · GHSA

CVE-2026-71498 · NVD

CVE-2026-71498 · MITRE

CVE-2026-71498 · OSV

UBUNTU-CVE-2026-71498 · OSV

Track software like this

Free during beta