node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-71498 · Microsoft / collected KEV context

GHSA-j4r3-hg7j-8chg

cve-program · CVE-2026-71498

• https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg
• https://github.com/uhop/node-re2/issues/272
• https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4

nvd · CVE-2026-71498

• https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4
• https://github.com/uhop/node-re2/issues/272
• https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg

osv · GHSA-j4r3-hg7j-8chg

• https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg
• https://github.com/uhop/node-re2/issues/272
• https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4
• https://github.com/uhop/node-re2

No related operational record is retained in the current change model.