CVE-2026-71498 node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
An out-of-bounds heap read in node-re2 allows attackers to disclose adjacent memory contents by passing a Buffer with a truncated UTF-8 character.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71498?
CVE-2026-71498 is a medium-severity vulnerability in uhop node-re2, published on 6 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.
Weakness: CWE-125
Which versions are affected by CVE-2026-71498?
2 open source packages ship an affected version, including re2.
| Package | Affected | Fixed in |
|---|---|---|
re2 npm | All versions | 1.26.1 |
re2 npm | All versions | 1.26.1 |
How do I fix CVE-2026-71498?
Upgrade re2 to 1.26.1 or later.
Is CVE-2026-71498 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71498 exists.
Sources
Also known as CLEANSTART-2026-PN94249, DEBIAN-CVE-2026-71498, GHSA-j4r3-hg7j-8chg, MINI-x5c2-gwrv-vjwq, UBUNTU-CVE-2026-71498.