Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-71430 EUVD-2026-54159GHSA-8hcv-x26h-mcgp

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

Published Aug 6, 2026 · Updated Aug 7, 2026 · Assigned by GitHub_M

Description

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.

Affected products

VendorProductAffectedFixed
uhop node-re2 < 1.25.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-re2 1.26.1+~cs1.7.0-1 —
Debian 13 node-re2 No fix yet —
Debian 12 node-re2 No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-re2 No fix yet —
Ubuntu 26.04 LTS node-re2 No fix yet —
Ubuntu 24.04 LTS node-re2 No fix yet —
Ubuntu 22.04 LTS node-re2 No fix yet —
Ubuntu 20.04 LTS node-re2 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
npm re2 < 1.25.1 1.25.1 GHSA-8hcv-x26h-mcgp

References