{"id":"CVE-2026-71498","sourceIdentifier":"security-advisories@github.com","published":"2026-08-06T22:18:32.207","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1."},{"lang":"es","value":"node-re2 proporciona enlaces de expresiones regulares RE2 para Node.js. Antes de la versión 1.26.1, pasar un Buffer cuyos bytes finales formaran una secuencia UTF-8 multibyte truncada (incompleta) podría causar que el enlace nativo leyera más allá del final del buffer asignado mientras intentaba decodificar el punto de código final e incompleto. Esto podría resultar en una lectura fuera de límites y una posible divulgación del contenido de memoria adyacente. Este problema está solucionado en la versión 1.26.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"uhop","product":"node-re2","versions":[{"version":"< 1.26.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.5,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-07T14:57:08.840534Z","id":"CVE-2026-71498","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4","source":"security-advisories@github.com"},{"url":"https://github.com/uhop/node-re2/issues/272","source":"security-advisories@github.com"},{"url":"https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg","source":"security-advisories@github.com"},{"url":"https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}