CVE-2026-71430

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

Details

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71430.json",
    "cwe_ids": [
        "CWE-617"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/uhop/node-re2

Affected ranges

Type

GIT

Repo

https://github.com/uhop/node-re2

Events

Introduced

Fixed

162ea7c5c90c755d4d0733f841cfa4788e13de56

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.25.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.9.0

1.*

1.0.0

1.1.0

1.1.1

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.10.5

1.11.0

1.12.0

1.12.1

1.13.0

1.14.0

1.15.0

1.15.1

1.15.2

1.15.3

1.15.4

1.15.5

1.15.6

1.15.7

1.15.8

1.15.9

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.17.4

1.17.5

1.17.6

1.17.7

1.17.8

1.18.0

1.18.1

1.18.2

1.18.3

1.19.0

1.19.1

1.19.2

1.2.0

1.20.0

1.20.1

1.20.10

1.20.11

1.20.12

1.20.2

1.20.3

1.20.4

1.20.5

1.20.6

1.20.7

1.20.8

1.20.9

1.21.0

1.21.1

1.21.2

1.21.3

1.21.4

1.21.5

1.22.0

1.22.1

1.22.2

1.22.3

1.23.0

1.23.1

1.23.2

1.23.3

1.24.0

1.24.1

1.25.0

1.3.0

1.3.1

1.3.2

1.3.3

1.4.0

1.4.1

1.5.0

1.6.0

1.6.1

1.6.2

1.7.0

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71430.json"