# CVE-2026-67550: uhop node-re2 out-of-bounds read in exec and match functions

Source: https://junglewise.ai/threats/cve-2026-67550-uhop-node-re2-out-of-bounds-read-in-exec-and-match-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-67550 · Severity: medium · CVSS 5.7 · Published 2026-07-30

A vulnerability in the re2 regular expression library for Node.js can cause an application to crash unexpectedly when processing certain text. This occurs when an attacker provides a specific starting position for a search on text containing non-standard characters (like emojis or non-English scripts). Because the crash happens at a deep system level, standard error handling cannot prevent the entire service from shutting down, potentially leading to a denial of service.

Technologies: [re2 (npm)](https://junglewise.ai/threats/technologies/npm-re2), [Uhop Re2](https://junglewise.ai/threats/technologies/re2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Uhop](https://junglewise.ai/threats/vendors/uhop).

## Quick answers

**Is CVE-2026-67550 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67550 being exploited in the wild.

**How severe is CVE-2026-67550?** Medium severity, with a CVSS score of 5.7, published 30 July 2026.

**Which products and versions are affected?** re2 (npm) SEMVER:introduced=0,fixed=1.25.2; Uhop Re2 < 1.25.2, <= 1.25.1.

**Is there a fix for CVE-2026-67550?** Yes. re2 (npm): upgrade to 1.25.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67550 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67550?** Check whether you run re2 (npm) or Uhop Re2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- re2 (npm): upgrade to 1.25.2 or later

  ```sh
  npm install re2@1.25.2
  ```


## Technical details

The vulnerability exists in the `StrVal::setIndex` and `getUtf16PositionByCounter` functions within `lib/addon.cc` and `lib/wrapped_re2.h`. The library validates the user-supplied `lastIndex` against the UTF-8 byte length of the subject string but subsequently treats that index as a UTF-16 code-unit count when walking the buffer. For non-ASCII subjects where byte length exceeds character count, an attacker can set `lastIndex` to a value that passes validation but points beyond the allocated buffer. This results in an out-of-bounds read that can cause a segmentation fault (DoS) or, in some cases, leak adjacent heap memory into the return value. The issue affects `exec`, `test`, `match`, `replace`, and `split` operations. Fixed in version 1.25.2.

## Affected products

- uhop re2 (npm) <= 1.25.1

## Identifiers

- CVE-2026-67550
- GHSA-ff84-5f28-78qj

## Timeline

- 2026-07-07: patched: Fixed in version 1.25.2
- 2026-07-30: advisory: NVD published CVE-2026-67550
- 2026-07-31: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/ataberk-xyz](https://api.github.com/users/ataberk-xyz)
- [https://github.com/ataberk-xyz](https://github.com/ataberk-xyz)
- [https://api.github.com/users/ataberk-xyz/gists%7B/gist_id%7D](https://api.github.com/users/ataberk-xyz/gists%7B/gist_id%7D)
- [https://api.github.com/users/ataberk-xyz/repos](https://api.github.com/users/ataberk-xyz/repos)
- [https://avatars.githubusercontent.com/u/13886709?v=4](https://avatars.githubusercontent.com/u/13886709?v=4)
- [https://api.github.com/users/ataberk-xyz/events%7B/privacy%7D](https://api.github.com/users/ataberk-xyz/events%7B/privacy%7D)

## Related threats

- [uhop node-re2 out-of-bounds heap read in replace and split](https://junglewise.ai/threats/cve-2026-71498-uhop-node-re2-out-of-bounds-heap-read-in-replace-and-split)
- [node-re2 process abort via large string replacement](https://junglewise.ai/threats/cve-2026-71430-node-re2-process-abort-via-large-string-replacement)
- [uhop re2 infinite loop in String.prototype.match](https://junglewise.ai/threats/cve-2026-68499-uhop-re2-infinite-loop-in-string-prototype-match)