CVE-2026-67550
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
5.7 / 10
Vector String
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Vulnerability Description
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-125
Source
NVD
Vendor
uhop
Product
node-re2
Discussion (0)
Add Comment
No comments yet. Be the first!