CVE-2026-71430

node-re2 provides RE2 bindings for Node.js. Prior to version 1.25.1, WrappedRE2::Replace could build a replacement result that exceeded V8’s maximum string length and call ToLocalChecked without checking the empty MaybeLocal. In such cases, a global replace with an output-amplifying template coul...