CVE-2026-67550

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.4 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d
https://github.com/uhop/node-re2/releases/tag/1.25.2
https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj
https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) re2 proporciona enlaces de Node.js para el motor de expresiones regulares RE2 de Google. Antes de la versión 1.25.2, re2 valida ’lastIndex’ contra la longitud en bytes UTF-8 de un sujeto, pero lo utiliza como un desplazamiento de unidad de código UTF-16 en ’exec’, ’test’, ’match’, ’replace’ y ’split’, permitiendo que un ’lastIndex’ influenciado por un atacante en un sujeto no ASCII desencadene una lectura de pila fuera de límites y un fallo de proceso irrecuperable, con revelación de información limitada de la pila en algunos casos. Este problema se ha solucionado en la versión 1.25.2.

Information

Published : 2026-07-30 20:18

Updated : 2026-10-23 22:10

NVD link : CVE-2026-67550

Mitre link : CVE-2026-67550

CVE.ORG link : CVE-2026-67550

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-67550", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67550", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T23:06:52.923503Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 1.4}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "uhop", "product": "node-re2", "versions": [{"status": "affected", "version": "< 1.25.2"}]}]}], "published": "2026-07-30T20:18:15.030", "references": [{"url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d", "source": "security-advisories@github.com"}, {"url": "https://github.com/uhop/node-re2/releases/tag/1.25.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj", "source": "security-advisories@github.com"}, {"url": "https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2."}, {"lang": "es", "value": "re2 proporciona enlaces de Node.js para el motor de expresiones regulares RE2 de Google. Antes de la versi\u00f3n 1.25.2, re2 valida \u2019lastIndex\u2019 contra la longitud en bytes UTF-8 de un sujeto, pero lo utiliza como un desplazamiento de unidad de c\u00f3digo UTF-16 en \u2019exec\u2019, \u2019test\u2019, \u2019match\u2019, \u2019replace\u2019 y \u2019split\u2019, permitiendo que un \u2019lastIndex\u2019 influenciado por un atacante en un sujeto no ASCII desencadene una lectura de pila fuera de l\u00edmites y un fallo de proceso irrecuperable, con revelaci\u00f3n de informaci\u00f3n limitada de la pila en algunos casos. Este problema se ha solucionado en la versi\u00f3n 1.25.2."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security-advisories@github.com"}