Cloudanix VulnDB

CVE-2026-67550

Medium · 5.7

CVSS

5.7

EPSS

0.2%

Published

Jul 30, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a regular-expression library can make programs crash or leak small pieces of memory when they process certain non-English text supplied by an attacker.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Mismatch between UTF-8 byte-length validation and UTF-16 code-unit offset usage for lastIndex in exec/test/match/replace/split allows attacker-controlled lastIndex on non-ASCII input to cause out-of-bounds heap read, process crash, and limited heap disclosure.

Why it matters to the business

Applications using the library for regex operations on user-controlled or internationalized text can experience sudden uncatchable crashes leading to denial of service and possible exposure of small amounts of heap memory.

How an attack unfolds

An attacker supplies a non-ASCII subject string and manipulates the lastIndex property of a RegExp instance before invoking exec, test, match, replace, or split; the library's inconsistent offset handling then reads past the allocated heap buffer, triggering a crash and, in some builds, returning limited adjacent heap contents.

How to fix it

Upgrade re2 to version 1.25.2 or later; where immediate upgrade is not possible, sanitize or reject non-ASCII input before regex operations or wrap calls in isolated worker processes to contain crashes.

How to confirm the fix worked

Confirm the installed package version is at least 1.25.2; run the library's test suite with non-ASCII subjects and manipulated lastIndex values to verify absence of crashes or out-of-bounds behavior.

Typical attack path

  1. Identify code paths that accept attacker-controlled strings and expose a RegExp lastIndex setter.
  2. Craft a non-ASCII subject whose UTF-8 length differs from its UTF-16 length.
  3. Set lastIndex to a value beyond the UTF-8-validated length but within the UTF-16 interpretation.
  4. Invoke one of the affected methods (exec, test, match, replace, split) to trigger the out-of-bounds read and crash.

How to detect it

Review application and Node.js process logs for abrupt terminations during regex method calls; correlate with requests containing non-ASCII characters and inspect heap dumps or core files for evidence of out-of-bounds reads.

What your security team should do

  • Prioritize upgrade to 1.25.2 in all Node.js services using re2 within the next sprint.
  • Add runtime guards that reset lastIndex on RegExp objects handling untrusted input.
  • Monitor crash logs for sudden process terminations during regex operations on internationalized data.

The record

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities