uhop node-re2 up to 1.25.1 exec/test/match/replace/split lastIndex out-of-bounds

Summaryinfo

A vulnerability has been found in uhop node-re2 up to 1.25.1 and classified as critical. The impacted element is the function exec/test/match/replace/split. This manipulation of the argument lastIndex causes out-of-bounds. The identification of this vulnerability is CVE-2026-67550. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in uhop node-re2 up to 1.25.1. It has been declared as critical. Affected by this vulnerability is the function exec/test/match/replace/split. The manipulation of the argument lastIndex with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-67550 since 07/29/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.25.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• uhop

Name

• node-re2

Version

• 1.25.0
• 1.25.1

Website

• Product: https://github.com/uhop/node-re2/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion