uhop node-re2 up to 1.25.0 Replace WrappedRE2::Replace return value

Summaryinfo

A vulnerability categorized as problematic has been discovered in uhop node-re2 up to 1.25.0. This impacts the function WrappedRE2::Replace of the component Replace. Such manipulation leads to return value. This vulnerability is uniquely identified as CVE-2026-71430. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in uhop node-re2 up to 1.25.0. Affected by this issue is the function WrappedRE2::Replace of the component Replace. The manipulation with an unknown input leads to a return value vulnerability. Using CWE to declare the problem leads to CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. Impacted is availability. CVE summarizes:

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-71430 since 08/06/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.25.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• uhop

Name

• node-re2

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25.0

Website

• Product: https://github.com/uhop/node-re2/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion