re2

npm · Package

4 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScriptCVE-2026-71498 · GHSA-J4R3-HG7J-8CHG	re2	npm	Medium	Fix reported	2026-08-07
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string lengthCVE-2026-71430 · GHSA-8HCV-X26H-MCGP	re2	npm	Medium	Fix reported	2026-08-07
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)CVE-2026-68499 · GHSA-6HXR-MR5R-9836	re2	npm	Medium	Fix reported	2026-07-31
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)CVE-2026-67550 · GHSA-FF84-5F28-78QJ	re2 Red Hat Enterprise Linux AI (RHEL AI) 3/re2	npmRed Hat	Medium	Fix reported	2026-07-31