p PatchFirst

CVE-2026-67550

CVE-2026-67550 · re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.

CVSS 5.7 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node-re2

    Versions
    • < 1.25.2: Affected

    No fix published

  • node-re2 Debian:12

    Versions
    • 1.18.0+~cs2.13.8-1
    • 1.19.2+~cs2.13.13-1
    • 1.20.10+~cs2.13.13-1
    • 1.20.12+~cs2.13.13-1
    • 1.21.4+~cs2.13.13-1
    • 1.21.4+~cs2.13.13-2
    • 1.22.1+~cs1.3.5-1
    • 1.23.3+~cs1.3.5-1
    • 1.25.0+~cs1.6.0-1
    • 1.25.0+~cs1.6.0-2
    • 1.26.1+~cs1.7.0-1
    • 1.26.1+~cs1.8.0-1
    • 1.27.0+~cs1.8.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Debian:13

    Versions
    • 1.21.4+~cs2.13.13-2
    • 1.22.1+~cs1.3.5-1
    • 1.23.3+~cs1.3.5-1
    • 1.25.0+~cs1.6.0-1
    • 1.25.0+~cs1.6.0-2
    • 1.26.1+~cs1.7.0-1
    • 1.26.1+~cs1.8.0-1
    • 1.27.0+~cs1.8.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Debian:14

    Versions
    • 1.21.4+~cs2.13.13-2
    • 1.22.1+~cs1.3.5-1
    • 1.23.3+~cs1.3.5-1
    • 1.25.0+~cs1.6.0-1
    • 1.25.0+~cs1.6.0-2
    Affected ranges
    • ECOSYSTEM: < 1.26.1+~cs1.7.0-1

    Update to 1.26.1+~cs1.7.0-1

  • re2 npm

    Affected ranges
    • SEMVER: < 1.25.2

    Update to 1.25.2

  • node-re2 Ubuntu:20.04:LTS

    Versions
    • 1.10.4-1
    • 1.10.5-1
    • 1.10.5-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Ubuntu:22.04:LTS

    Versions
    • 1.15.9+~cs1.8.18-1
    • 1.15.9+~cs1.8.18-2
    • 1.16.0+~cs2.12.8-2
    • 1.17.1+~cs2.12.8-1
    • 1.17.2+~cs2.13.8-1
    • 1.17.3+~cs2.13.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Ubuntu:24.04:LTS

    Versions
    • 1.18.0+~cs2.13.8-1build1
    • 1.19.2+~cs2.13.13-1build1
    • 1.20.10+~cs2.13.13-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Ubuntu:26.10

    Versions
    • 1.23.3+~cs1.3.5-1
    • 1.25.0+~cs1.6.0-2
    • 1.26.1+~cs1.7.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-re2 Ubuntu:26.04:LTS

    Versions
    • 1.22.1+~cs1.3.5-1
    • 1.22.1+~cs1.3.5-1build2
    • 1.22.1+~cs1.3.5-1build3
    • 1.23.3+~cs1.3.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →