{"id":"CVE-2026-71498","aliases":["DEBIAN-CVE-2026-71498","EUVD-2026-54165","GHSA-j4r3-hg7j-8chg","UBUNTU-CVE-2026-71498"],"status":"published","title":"node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript","description":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.","severity":{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00174,"percentile":0.06884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-08-06T21:26:00Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"npm","package":"re2","fixed_in":["1.26.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-re2","fixed_in":["1.26.1+~cs1.7.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"re2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.0"},{"fixed":"1.26.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-re2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0+~cs2.13.8-1","1.19.2+~cs2.13.13-1","1.20.10+~cs2.13.13-1","1.20.12+~cs2.13.13-1","1.21.4+~cs2.13.13-1","1.21.4+~cs2.13.13-2","1.22.1+~cs1.3.5-1","1.23.3+~cs1.3.5-1","1.25.0+~cs1.6.0-1","1.25.0+~cs1.6.0-2","1.26.1+~cs1.7.0-1","1.26.1+~cs1.8.0-1","1.27.0+~cs1.8.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-re2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.4+~cs2.13.13-2","1.22.1+~cs1.3.5-1","1.23.3+~cs1.3.5-1","1.25.0+~cs1.6.0-1","1.25.0+~cs1.6.0-2","1.26.1+~cs1.7.0-1","1.26.1+~cs1.8.0-1","1.27.0+~cs1.8.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-re2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1+~cs1.7.0-1"}]}],"versions":["1.21.4+~cs2.13.13-2","1.22.1+~cs1.3.5-1","1.23.3+~cs1.3.5-1","1.25.0+~cs1.6.0-1","1.25.0+~cs1.6.0-2"]},{"source":"osv","ecosystem":"npm","package":"re2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-re2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-1","1.10.5-1","1.10.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-re2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.9+~cs1.8.18-1","1.15.9+~cs1.8.18-2","1.16.0+~cs2.12.8-2","1.17.1+~cs2.12.8-1","1.17.2+~cs2.13.8-1","1.17.3+~cs2.13.8-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-re2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0+~cs2.13.8-1build1","1.19.2+~cs2.13.13-1build1","1.20.10+~cs2.13.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-re2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.3+~cs1.3.5-1","1.25.0+~cs1.6.0-2","1.26.1+~cs1.7.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-re2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1+~cs1.3.5-1","1.22.1+~cs1.3.5-1build2","1.22.1+~cs1.3.5-1build3","1.23.3+~cs1.3.5-1"]}],"products":[{"vendor":"uhop","product":"node-re2"}],"references":[{"url":"https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/uhop/node-re2/issues/272","tags":["x_refsource_MISC","report","web"]},{"url":"https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/advisories/GHSA-j4r3-hg7j-8chg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71498.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71498","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-71498","tags":["advisory"]},{"url":"https://github.com/uhop/node-re2","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-71498","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71498","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-71498","title":"node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript","description":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.","status":"published","published":"2026-08-06T21:26:00.771Z","modified":"2026-08-07T17:08:50.825Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-54165","description":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.","status":"published","published":"2026-08-06T21:26:00Z","modified":"2026-08-07T17:08:50Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:02:06.930016Z"}],"ghsa":[{"id":"GHSA-j4r3-hg7j-8chg","title":"node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript","description":"## Summary\n\n`re2` infers a character's byte length from its UTF-8 lead byte alone, with no bound on the\nbytes actually remaining in the input. `Buffer` arguments reach the native layer verbatim —\nonly strings are re-encoded into well-formed UTF-8 — so a `Buffer` whose last byte is a\nmulti-byte lead promises continuation bytes that are not there, and the result builders read\nup to 3 bytes past the end of the buffer. In `replace()` and `split()` those bytes are copied\ninto the returned `Buffer`, disclosing adjacent heap memory to JavaScript. The trigger is\ndeterministic and requires no special heap grooming.\n\nOnly `Buffer` input is affected. String input was never at risk: re-encoding guarantees every\nmulti-byte sequence is complete.\n\n## Root cause\n\n`getUtf8CharSize` maps a lead byte to a length of 1–4 and never sees the input size:\n\n```cpp\n// lib/wrapped_re2.h\ninline size_t getUtf8CharSize(char ch)\n{\n      return ((0xE5000000 \u003e\u003e ((ch \u003e\u003e 3) \u0026 0x1E)) \u0026 3) + 1;\n}\n```\n\nCallers then read that many bytes. In the zero-width branch of `replace()`, the guard proves\nonly that at least *one* byte remains:\n\n```cpp\n// lib/replace.cc\nelse if ((size_t)offset \u003c size)\n{\n      auto sym_size = getUtf8CharSize(data[offset]);   // may claim up to 4 bytes\n      result.append(data + offset, sym_size);          // reads data[offset .. offset + 3]\n      byteIndex = offset + sym_size;\n}\n```\n\n`offset \u003c size` permits `offset == size - 1`, so a lead byte of `0xF0` makes `append` read\n`data[size]`, `data[size + 1]` and `data[size + 2]`.\n\nSeven read sites shared the defect:\n\n| Site | Argument | Disclosed to JS |\n|---|---|---|\n| `lib/replace.cc` (zero-width branch) | subject | yes |\n| `lib/replace.cc` (callback replacer) | subject | yes |\n| `lib/replace.cc` (replacement scan) | replacement | yes |\n| `lib/split.cc` | subject | yes |\n| `lib/pattern.cc` `translateRegExp` (x2) | pattern | no |\n| `lib/pattern.cc` `escapeRegExp` | pattern | no |\n\nThree further callers were **not** vulnerable, because they use the result only to advance an\nindex and never dereference past the end: `getUtf16PositionByCounter` in `lib/wrapped_re2.h`\n(clamps its return to the buffer size), `lib/match.cc` (the value feeds `RE2::Match`, which\nrejects `startpos \u003e endpos`), and the `getMaxSubmatch` scan in `lib/replace.cc` (an overshoot\njust ends the loop).\n\n## Proof of concept\n\nEach call returns more bytes than were supplied; the trailing bytes are heap contents and vary\nbetween runs.\n\n```js\nconst RE2 = require('re2');\nconst hex = buf =\u003e [...buf].map(b =\u003e b.toString(16).padStart(2, '0')).join(' ');\n\n// subject: 2 bytes in, 5 bytes out\nconsole.log(hex(new RE2('', 'g').replace(Buffer.from([0x41, 0xf0]), '')));\n// 41 f0 61 7b eb   \u003c- last 3 bytes are adjacent heap memory\n\n// replacement argument\nconsole.log(hex(new RE2('A', 'g').replace(Buffer.from('A'), Buffer.from([0x42, 0xf0]))));\n// 42 f0 41 26 d6\n\n// split\nconsole.log(new RE2('', 'g').split(Buffer.from([0x41, 0xf0])).map(hex));\n// [ '41', 'f0 e2 e4 df' ]\n```\n\n`0xC2` (2-byte lead) and `0xE2` (3-byte lead) over-read 1 and 2 bytes respectively; `0xF0`\nover-reads 3.\n\nFor the pattern path the over-read occurs in `translateRegExp` / `escapeRegExp`, which run\nbefore RE2 validates the pattern, but RE2 then rejects the malformed input, so the bytes are\ndiscarded rather than returned:\n\n```js\nnew RE2(Buffer.from([0xf0]));   // SyntaxError: invalid UTF-8 — read already happened\n```\n\n## Impact\n\n**Information disclosure (`replace`, `split`).** Up to 3 bytes of heap memory adjacent to the\ninput buffer are returned to JavaScript per call. The read is repeatable, so an attacker who\ncontrols `Buffer` input and observes output can sample heap memory incrementally. What lands\nthere depends on allocator layout and is not directly steerable, but it may include fragments\nof other buffers.\n\n**Out-of-bounds read (pattern compilation).** No disclosure path, since the malformed pattern\nis rejected — but the read is still undefined behavior and can fault if the buffer ends on a\npage boundary.\n\nApplications that pass only strings, or only well-formed UTF-8 buffers, are unaffected. The\nexposure matters most where `re2` is used as intended: running patterns or subjects derived\nfrom untrusted input.\n\n## Suggested fix\n\nClamp the inferred character size to the bytes that actually remain, at every site whose result\nindexes the buffer:\n\n```cpp\ninline size_t getUtf8CharSize(char ch, size_t remaining)\n{\n      size_t size = getUtf8CharSize(ch);\n      return size \u003c remaining ? size : remaining;\n}\n```\n\nThis is O(1) and changes no algorithm's complexity. A truncated tail then round-trips as the\nbytes it really holds, which preserves the documented contract that `Buffer` input is passed\nthrough verbatim. Rejecting malformed UTF-8 in `Buffer` input would also close the hole, but\nis a breaking API change.\n\n## Resolution\n\nFixed in `re2@1.26.1`.\n\nAll seven read sites now clamp the character size to the remaining input, so a `Buffer` ending\nin a truncated multi-byte character round-trips as its own bytes instead of reading past the\nend. Regression tests cover the subject, replacement and pattern positions for 2-, 3- and\n4-byte leads, including partially truncated sequences.\n\n**Remediation:** upgrade to `re2@1.26.1` or later.\n\n**Workaround** (if you cannot upgrade): pass strings rather than `Buffer`s, or validate that\n`Buffer` input is well-formed UTF-8 before calling `replace`, `split`, or the `RE2`\nconstructor — for example `Buffer.compare(Buffer.from(buf.toString('utf8')), buf) === 0`.\n\nReported by [@OvOhao](https://github.com/OvOhao) in [#272](https://github.com/uhop/node-re2/issues/272).","status":"published","published":"2026-08-06T21:26:14Z","modified":"2026-08-06T21:26:16Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:40:57.999375Z"}],"nvd":[{"id":"CVE-2026-71498","description":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.","status":"published","published":"2026-08-06T22:18:32.207Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"CVE-2026-71498","title":"node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript","description":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.","status":"published","published":"2026-08-06T21:26:00.771Z","modified":"2026-10-28T02:30:58.914884432Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-71498","description":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.","status":"published","published":"2026-08-06T22:18:32.207Z","modified":"2026-10-25T09:47:34.108949921Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"GHSA-j4r3-hg7j-8chg","title":"node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript","description":"## Summary\n\n`re2` infers a character's byte length from its UTF-8 lead byte alone, with no bound on the\nbytes actually remaining in the input. `Buffer` arguments reach the native layer verbatim —\nonly strings are re-encoded into well-formed UTF-8 — so a `Buffer` whose last byte is a\nmulti-byte lead promises continuation bytes that are not there, and the result builders read\nup to 3 bytes past the end of the buffer. In `replace()` and `split()` those bytes are copied\ninto the returned `Buffer`, disclosing adjacent heap memory to JavaScript. The trigger is\ndeterministic and requires no special heap grooming.\n\nOnly `Buffer` input is affected. String input was never at risk: re-encoding guarantees every\nmulti-byte sequence is complete.\n\n## Root cause\n\n`getUtf8CharSize` maps a lead byte to a length of 1–4 and never sees the input size:\n\n```cpp\n// lib/wrapped_re2.h\ninline size_t getUtf8CharSize(char ch)\n{\n      return ((0xE5000000 \u003e\u003e ((ch \u003e\u003e 3) \u0026 0x1E)) \u0026 3) + 1;\n}\n```\n\nCallers then read that many bytes. In the zero-width branch of `replace()`, the guard proves\nonly that at least *one* byte remains:\n\n```cpp\n// lib/replace.cc\nelse if ((size_t)offset \u003c size)\n{\n      auto sym_size = getUtf8CharSize(data[offset]);   // may claim up to 4 bytes\n      result.append(data + offset, sym_size);          // reads data[offset .. offset + 3]\n      byteIndex = offset + sym_size;\n}\n```\n\n`offset \u003c size` permits `offset == size - 1`, so a lead byte of `0xF0` makes `append` read\n`data[size]`, `data[size + 1]` and `data[size + 2]`.\n\nSeven read sites shared the defect:\n\n| Site | Argument | Disclosed to JS |\n|---|---|---|\n| `lib/replace.cc` (zero-width branch) | subject | yes |\n| `lib/replace.cc` (callback replacer) | subject | yes |\n| `lib/replace.cc` (replacement scan) | replacement | yes |\n| `lib/split.cc` | subject | yes |\n| `lib/pattern.cc` `translateRegExp` (x2) | pattern | no |\n| `lib/pattern.cc` `escapeRegExp` | pattern | no |\n\nThree further callers were **not** vulnerable, because they use the result only to advance an\nindex and never dereference past the end: `getUtf16PositionByCounter` in `lib/wrapped_re2.h`\n(clamps its return to the buffer size), `lib/match.cc` (the value feeds `RE2::Match`, which\nrejects `startpos \u003e endpos`), and the `getMaxSubmatch` scan in `lib/replace.cc` (an overshoot\njust ends the loop).\n\n## Proof of concept\n\nEach call returns more bytes than were supplied; the trailing bytes are heap contents and vary\nbetween runs.\n\n```js\nconst RE2 = require('re2');\nconst hex = buf =\u003e [...buf].map(b =\u003e b.toString(16).padStart(2, '0')).join(' ');\n\n// subject: 2 bytes in, 5 bytes out\nconsole.log(hex(new RE2('', 'g').replace(Buffer.from([0x41, 0xf0]), '')));\n// 41 f0 61 7b eb   \u003c- last 3 bytes are adjacent heap memory\n\n// replacement argument\nconsole.log(hex(new RE2('A', 'g').replace(Buffer.from('A'), Buffer.from([0x42, 0xf0]))));\n// 42 f0 41 26 d6\n\n// split\nconsole.log(new RE2('', 'g').split(Buffer.from([0x41, 0xf0])).map(hex));\n// [ '41', 'f0 e2 e4 df' ]\n```\n\n`0xC2` (2-byte lead) and `0xE2` (3-byte lead) over-read 1 and 2 bytes respectively; `0xF0`\nover-reads 3.\n\nFor the pattern path the over-read occurs in `translateRegExp` / `escapeRegExp`, which run\nbefore RE2 validates the pattern, but RE2 then rejects the malformed input, so the bytes are\ndiscarded rather than returned:\n\n```js\nnew RE2(Buffer.from([0xf0]));   // SyntaxError: invalid UTF-8 — read already happened\n```\n\n## Impact\n\n**Information disclosure (`replace`, `split`).** Up to 3 bytes of heap memory adjacent to the\ninput buffer are returned to JavaScript per call. The read is repeatable, so an attacker who\ncontrols `Buffer` input and observes output can sample heap memory incrementally. What lands\nthere depends on allocator layout and is not directly steerable, but it may include fragments\nof other buffers.\n\n**Out-of-bounds read (pattern compilation).** No disclosure path, since the malformed pattern\nis rejected — but the read is still undefined behavior and can fault if the buffer ends on a\npage boundary.\n\nApplications that pass only strings, or only well-formed UTF-8 buffers, are unaffected. The\nexposure matters most where `re2` is used as intended: running patterns or subjects derived\nfrom untrusted input.\n\n## Suggested fix\n\nClamp the inferred character size to the bytes that actually remain, at every site whose result\nindexes the buffer:\n\n```cpp\ninline size_t getUtf8CharSize(char ch, size_t remaining)\n{\n      size_t size = getUtf8CharSize(ch);\n      return size \u003c remaining ? size : remaining;\n}\n```\n\nThis is O(1) and changes no algorithm's complexity. A truncated tail then round-trips as the\nbytes it really holds, which preserves the documented contract that `Buffer` input is passed\nthrough verbatim. Rejecting malformed UTF-8 in `Buffer` input would also close the hole, but\nis a breaking API change.\n\n## Resolution\n\nFixed in `re2@1.26.1`.\n\nAll seven read sites now clamp the character size to the remaining input, so a `Buffer` ending\nin a truncated multi-byte character round-trips as its own bytes instead of reading past the\nend. Regression tests cover the subject, replacement and pattern positions for 2-, 3- and\n4-byte leads, including partially truncated sequences.\n\n**Remediation:** upgrade to `re2@1.26.1` or later.\n\n**Workaround** (if you cannot upgrade): pass strings rather than `Buffer`s, or validate that\n`Buffer` input is well-formed UTF-8 before calling `replace`, `split`, or the `RE2`\nconstructor — for example `Buffer.compare(Buffer.from(buf.toString('utf8')), buf) === 0`.\n\nReported by [@OvOhao](https://github.com/OvOhao) in [#272](https://github.com/uhop/node-re2/issues/272).","status":"published","published":"2026-08-06T21:26:14Z","modified":"2026-08-06T21:40:58.308038Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"UBUNTU-CVE-2026-71498","description":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.","status":"published","published":"2026-08-06T22:18:00Z","modified":"2026-10-17T13:00:43.51764285Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:03.035847Z"}]}}