{"uuid": "a1bc5e43-de18-4626-9fe9-94d3d93ef8fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71498", "type": "seen", "source": "https://gist.github.com/alon710/0c61a6195ede2fd8a0ca10d8b63bbf6e", "content": "# CVE-2026-71498: CVE-2026-71498: Out-of-bounds Heap Read in node-re2 via Truncated Multi-byte UTF-8 Characters\n\n> **CVSS Score:** 5.1\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71498\n\n## Summary\nA medium-severity out-of-bounds (OOB) heap read vulnerability exists in node-re2 prior to version 1.26.1. When a raw binary Node.js Buffer with a truncated multi-byte UTF-8 character at its end is passed to the C++ native addon, the internal lookahead routine getUtf8CharSize() over-reads up to 3 bytes from the heap, leading to memory disclosure.\n\n## TL;DR\nPassing a raw Node.js Buffer ending in a truncated multi-byte UTF-8 byte to node-re2 (< 1.26.1) causes a 3-byte heap over-read, leaking adjacent heap memory back to the JavaScript runtime.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125 (Out-of-bounds Read)\n- **Attack Vector**: Local\n- **CVSS v3.1**: 5.1 (Medium)\n- **Exploit Status**: PoC (Proof-of-Concept) documented\n- **KEV Status**: Not Listed\n- **Impact Type**: Information Disclosure / Memory Leakage\n\n## Affected Systems\n\n- node-re2 (npm package: re2) running on Node.js runtime environments\n- **re2**: < 1.26.1 (Fixed in: `1.26.1`)\n\n## Mitigation\n\n- Upgrade node-re2 (npm package: re2) to version 1.26.1 or later.\n- Sanitize Buffer inputs by casting them to standard JS UTF-8 strings before passing them to native RE2 routines.\n\n**Remediation Steps:**\n1. Open your project package.json and locate the 're2' dependency entry.\n2. Update the version identifier to '^1.26.1'.\n3. Run 'npm update re2' or 'yarn upgrade re2' to obtain the patched binaries.\n4. Optionally, wrap direct RE2 operations on buffer streams in a defensive validation layer that checks byte arrays for trailing malformed UTF-8 characters.\n\n## References\n\n- [GitHub Security Advisory GHSA-j4r3-hg7j-8chg](https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg)\n- [node-re2 GitHub Issue #272](https://github.com/uhop/node-re2/issues/272)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71498) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T05:35:28.632049Z"}