CVE-2026-71498: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence c

mediumCVSS 5.1CVE-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 5.1
Published: 2026-08-06
Last updated: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-71498

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-71498	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

mediumGHSA-j4r3-hg7j-8chg: node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncat…ghsa

Recent advisories for node-re2 provides RE2

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-71430: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the Wr…nvd · 2026-08-06

CVE-2026-71498: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence c

Details

Referenced CVEs

Same CVEs, other sources

Recent advisories for node-re2 provides RE2

More from NVD Recent CVEs