CVE-2026-71430: node-re2 process abort via large string replacement

Executive brief

A vulnerability in the node-re2 library, a popular tool for safe regular expression processing in Node.js, can cause an entire application to crash. When an attacker provides a specific input that results in a very large replacement string, the library fails to handle the memory limit correctly, leading to an unrecoverable process failure. This results in a denial of service that cannot be caught or prevented by standard error-handling code.

Technical details

The vulnerability exists in `WrappedRE2::Replace` within `lib/replace.cc`. When a global replacement using output-amplifying templates (like ` ` or `` ``) results in a string exceeding V8's `String::kMaxLength`, `Nan::New()` returns an empty `MaybeLocal`. The code calls `.ToLocalChecked()` on this empty handle without validation, triggering a fatal V8 error and a `SIGABRT`. Unlike the native Node.js regex engine which throws a catchable `RangeError`, this implementation causes a hard crash of the Node process. The issue is fixed in version 1.25.1 by adding proper checks for empty handles.

Affected products

• uhop re2 <= 1.25.0

Timeline

• 2026-07-07: disclosed
• 2026-08-06: advisory: GitHub Advisory published
• 2026-08-06: patched: Fixed in version 1.25.1

References

• https://api.github.com/users/ataberk-xyz
• https://github.com/ataberk-xyz
• https://api.github.com/users/ataberk-xyz/gists%7B/gist_id%7D
• https://api.github.com/users/ataberk-xyz/repos
• https://avatars.githubusercontent.com/u/13886709?v=4
• https://api.github.com/users/ataberk-xyz/events%7B/privacy%7D