re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.

A flaw was found in re2, a component that provides Node.js bindings for Google's RE2 regular expression engine. An attacker can exploit a vulnerability by manipulating the `lastIndex` parameter with a non-ASCII input. This manipulation can lead to an out-of-bounds heap read, causing the process to crash, which results in a Denial of Service (DoS). There is also a possibility of limited information disclosure from the heap.

This flaw primarily impacts Availability with low Confidentiality impact and zero effect on Integrity (C:L, I:N, A:H). Exploitation requires an attacker to manipulate the `lastIndex` property prior to executing regular expression operations on non-ASCII input, causing a mismatch between UTF-8 byte validation and UTF-16 code-unit offsets. Practically, this leads to an uncatchable process crash (Denial of Service) via an out-of-bounds heap read, though minor heap memory exposure is theoretically possible. High Attack Complexity (AC:H) is assessed because the targeted Node.js application must explicitly maintain and expose stateful regex objects with attacker-controlled `lastIndex` properties across non-ASCII strings. Applications using stateless regex execution or not accepting external input into `lastIndex` are unaffected. Applications using the `re2` Node.js bindings should ensure that the `lastIndex` property of regular expression objects is not directly influenced by untrusted external input. As an operational control, developers should either avoid assigning `lastIndex` from untrusted input or clamp its value to the subject's string length (`str.length`) before performing regex operations on non-ASCII subjects. Red Hat Enterprise Linux AI (RHEL AI) 3 Affected re2 Red Hat Hardened Images Not affected re2 https://www.cve.org/CVERecord?id=CVE-2026-67550 https://nvd.nist.gov/vuln/detail/CVE-2026-67550 https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d https://github.com/uhop/node-re2/releases/tag/1.25.2 https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj