CVE-2026-71498

6th percentile - higher than 6% of all known CVEs

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

The risk for the organization is the possibility of disclosing sensitive data from process memory, which can lead to information leakage or further attacks.

It is recommended to update the node-re2 library to version 1.26.1 or later, which fixes this vulnerability, and to avoid passing incomplete UTF-8 sequences to library functions.