Is CVE-2026-71430 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71430 being exploited in the wild.

How severe is CVE-2026-71430?

Medium severity, with a CVSS score of 6.2, published 6 August 2026.

Which products and versions are affected?

re2 (npm) SEMVER:introduced=0,fixed=1.25.1; Uhop Re2 <= 1.25.0.

Is there a fix for CVE-2026-71430?

Yes. re2 (npm): upgrade to 1.25.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71430 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-71430?

Check whether you run re2 (npm) or Uhop Re2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71430: node-re2 process abort via large string replacement

Q: Is there a fix for CVE-2026-71430?

Yes. re2 (npm): upgrade to 1.25.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-71430 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-71430?

Check whether you run re2 (npm) or Uhop Re2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71430 · Severity: medium · CVSS 6.2 · Published 2026-08-06

A vulnerability in the node-re2 library, a popular tool for safe regular expression processing in Node.js, can cause an entire application to crash. When an attacker provides a specific input that results in a very large replacement string, the library fails to handle the memory limit correctly, leading to an unrecoverable process failure. This results in a denial of service that cannot be caught or prevented by standard error-handling code.

Technologies: re2 (npm), Uhop Re2. Vendors: npm, Uhop.

Quick answers

Is CVE-2026-71430 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71430 being exploited in the wild.
How severe is CVE-2026-71430?: Medium severity, with a CVSS score of 6.2, published 6 August 2026.
Which products and versions are affected?: re2 (npm) SEMVER:introduced=0,fixed=1.25.1; Uhop Re2 <= 1.25.0.
Is there a fix for CVE-2026-71430?: Yes. re2 (npm): upgrade to 1.25.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71430 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-71430?: Check whether you run re2 (npm) or Uhop Re2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

re2 (npm): upgrade to 1.25.1 or later
```
npm install re2@1.25.1
```

Technical details

The vulnerability exists in `WrappedRE2::Replace` within `lib/replace.cc`. When a global replacement using output-amplifying templates (like `$'` or `` $` ``) results in a string exceeding V8's `String::kMaxLength`, `Nan::New()` returns an empty `MaybeLocal`. The code calls `.ToLocalChecked()` on this empty handle without validation, triggering a fatal V8 error and a `SIGABRT`. Unlike the native Node.js regex engine which throws a catchable `RangeError`, this implementation causes a hard crash of the Node process. The issue is fixed in version 1.25.1 by adding proper checks for empty handles.

Affected products

uhop re2 <= 1.25.0

Identifiers

CVE-2026-71430
GHSA-8hcv-x26h-mcgp

Timeline

2026-07-07: disclosed
2026-08-06: advisory: GitHub Advisory published
2026-08-06: patched: Fixed in version 1.25.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.