CVE-2026-71430 in node-re2
Summary
by MITRE • 08/07/2026
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The node-re2 library serves as a critical component in Node.js applications that require high-performance regular expression processing through the RE2 engine. This vulnerability affects versions prior to 1.25.1 and specifically targets the WrappedRE2::Replace function implementation within the library's C++ bindings. The flaw manifests when processing replacement operations that can produce output amplification, where the size of the replacement result grows disproportionately relative to the input data. When such operations are performed with global replace patterns using amplifying templates, the resulting string can expand quadratically in relation to input size, creating a potential denial-of-service vector.
The technical implementation issue stems from improper error handling within V8's JavaScript engine integration. The WrappedRE2::Replace function constructs replacement results and attempts to pass them to V8 using the ToLocalChecked method without validating whether V8 returns an empty MaybeLocal when string limits are exceeded. This approach fundamentally violates safe programming practices for memory management and error propagation in Node.js native add-ons. V8 enforces strict maximum string length limitations to prevent memory exhaustion attacks, but the unchecked call bypasses proper exception handling mechanisms that would normally allow applications to gracefully manage such conditions.
The operational impact of this vulnerability extends beyond simple service disruption to create a fatal process abort scenario that cannot be caught or handled by application code. When replacement operations exceed V8's maximum string length thresholds, the uncatchable nature of the abort means that entire Node.js processes terminate abruptly without any opportunity for cleanup or error reporting. This creates significant reliability concerns for applications that depend on node-re2 for text processing, particularly those handling untrusted input data where malicious actors could craft replacement templates designed to trigger this condition. The vulnerability aligns with CWE-704 in the Common Weakness Enumeration, which covers improper error handling and memory safety issues in compiled code.
This type of vulnerability falls under ATT&CK technique T1499.004 for network denial-of-service attacks and represents a critical security flaw in the software supply chain that affects applications using regular expression processing libraries. The quadratic growth behavior with amplifying templates creates an efficient attack vector where relatively small inputs can generate massive outputs, making it particularly dangerous in environments where input validation is insufficient or absent. Organizations relying on node-re2 for text processing should immediately update to version 1.25.1 or later, as this release implements proper error checking and graceful handling of V8 string length limitations.
The fix implemented in version 1.25.1 addresses the core issue by adding validation checks before calling ToLocalChecked, ensuring that potential empty MaybeLocal returns from V8 are properly handled. This approach aligns with industry best practices for native Node.js module development and follows the principle of defensive programming. The solution prevents the fatal process termination while maintaining the library's core functionality, allowing applications to handle string length exceeded conditions through normal exception handling mechanisms rather than experiencing abrupt crashes. Security teams should monitor their Node.js applications for usage of node-re2 and ensure all deployments are updated to patched versions to prevent exploitation of this vulnerability in production environments.