CVE-2026-67550

MediumCVSS 5.7

Published: 30/07/2026(UTC)Updated: 23/10/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The re2 library for Node.js prior to version 1.25.2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split. This allows an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases.

Risk Assessment

The organization risks crashes of Node.js applications using re2 and potential heap memory data leakage, which could compromise confidentiality and availability.

Recommendation

Update the re2 library to version 1.25.2 or later, which includes a fix that correctly uses lastIndex.

Other vulnerabilities in re2

CVE-2026-68499Medium
The re2 library for Node.js prior to version 1.25.2 contains a vulnerability in the String.prototype.match implementation with a global RE2 pattern that can match the empty string. The function fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory.

Original NVD description (English source)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS