11 matches found
CVE-2026-71430
creationtimestamp| type| source ---|---|--- 2026-08-06 22:35:12+00:00| published-proof-of-concept| https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp...
NPM: node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
NPM: node-re2: Out-of-bounds heap read in replace/split via a Buffer ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript vulnerability discovered by ? in WordPress Npm re2 versions = 1.26.0...
EUVD-2026-54165
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...
GHSA-8HCV-X26H-MCGP node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
Description WrappedRE2::Replace builds the replacement result and hands it to V8 with .ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the string/buffer exceeds its maximum length: lib/replace.cc v1.24.1: cpp // L553 — Buffer return path...
NPM: node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
NPM: node-re2: String.prototype.replacere2, template aborts the Node process uncatchable ToLocalChecked on empty MaybeLocal when the result exceeds V8's max string length vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.0...
EUVD-2026-54159
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...
CVE-2026-71430
node-re2 provides RE2 bindings for Node.js. Prior to version 1.25.1, WrappedRE2::Replace could build a replacement result that exceeded V8’s maximum string length and call ToLocalChecked without checking the empty MaybeLocal. In such cases, a global replace with an output-amplifying template coul...
CVE-2026-71430 node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...
CVE-2026-71430
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...