CVE-2026-71498: Out-of-bounds Heap Read in node-re2 via Truncated Multi-byte UTF-8 Characters

CVE-2026-71498 describes a medium-severity out-of-bounds heap read vulnerability affecting node-re2, the Node.js native bindings for Google's RE2 regular expression library. The flaw is present in versions of the re2 npm package prior to 1.26.1. It manifests when processing raw binary Node.js Buffer objects that terminate with a truncated or incomplete multi-byte UTF-8 character sequence.

While standard JavaScript strings are subjected to validation and sanitization by the V8 engine during serialization, Node.js Buffer objects bypass this layer. Consequently, raw and malformed byte sequences are passed directly to the underlying C++ addon. When the native library attempts to parse these sequences, it fails to validate internal pointer boundaries against the physical allocation limits of the buffer.

The vulnerability resides within the utility function used to compute character sizes based on the lead byte. If an input buffer ends abruptly with a lead byte indicating a multi-byte sequence, the module attempts to read forward by the declared character width. This causes the application to read past the end of the allocated buffer, exposing adjacent memory segments on the heap.

The root cause of CVE-2026-71498 is a lack of boundary verification in the native utility functions of the node-re2 module. The module relies on the fast-path helper function getUtf8CharSize(char ch) defined inside lib/wrapped_re2.h to determine the length of a UTF-8 character sequence. This function determines character width solely by inspecting the bit patterns of the leading byte.

For instance, when encountering a byte with the high bits 11110xxx (such as 0xF0), the bitwise algorithm concludes that the character spans four bytes. This logic operates under the assumption that the input data represents a valid, well-formed UTF-8 stream. It contains no parameters or logical checks to account for the actual remaining length of the memory allocation.

When a truncated sequence is processed, such as a buffer of size 2 ending in 0xF0, the lookahead mechanism is triggered. The iteration loop determines that there is still one byte remaining to process, satisfying basic index checks. However, once getUtf8CharSize returns a size of 4, the application copies four bytes starting from the truncated lead byte, causing a three-byte out-of-bounds read.

The vulnerable version of node-re2 exposes several file-level callsites where the lookahead check is executed without size boundaries. In files such as lib/replace.cc, lib/split.cc, and lib/pattern.cc, character parsing routines call getUtf8CharSize(ch) with only the character value.

The following code block highlights the vulnerable construction in lib/replace.cc where the over-read occurs:

// Vulnerable path in lib/replace.cc
else if ((size_t)offset < size) {
    // getUtf8CharSize only receives the character byte
    auto sym_size = getUtf8CharSize(data[offset]);  
    // Reads sym_size bytes from current offset, overshooting buffer bounds
    result.append(data + offset, sym_size);         
    byteIndex = offset + sym_size;
}

The issue is resolved in version 1.26.1 by overloading the helper function in lib/wrapped_re2.h to accept the remaining size of the buffer. The new implementation dynamically clamps the returned character size to the actual bytes left in the allocation.

// Patched helper in lib/wrapped_re2.h
inline size_t getUtf8CharSize(char ch, size_t remaining)
{
    size_t size = getUtf8CharSize(ch);
    // Clamps the return value to prevent reading beyond allocation limits
    return size < remaining ? size : remaining; 
}

With this change, all callsites within lib/replace.cc, lib/split.cc, and lib/pattern.cc were updated to calculate the remaining bounds and supply this as the second parameter. For example, getUtf8CharSize(ch) was replaced with getUtf8CharSize(ch, size - i). This modification prevents any possibility of reading past the allocated memory buffer.

Exploitation of CVE-2026-71498 requires that an application use node-re2 to process untrusted binary input via a Node.js Buffer. The attacker must be able to control or manipulate the contents of the buffer so that it ends with a truncated multi-byte UTF-8 character. Common execution paths include processing user-uploaded file buffers, network packet payloads, or raw stream segments.

No complex heap layout manipulation or administrative privileges are required to trigger the vulnerability. When the malformed buffer is supplied to functions like replace(), split(), or compiled as a pattern using new RE2(), the C++ layer over-reads up to 3 bytes from adjacent heap space.

The leaked adjacent heap bytes are written into the output structure of the operation and returned to the JavaScript runtime as a new Buffer or String. An attacker can repeat this process systematically to leak sequential chunks of heap memory. This can lead to the exposure of sensitive session tokens, internal system variables, or private cryptographic keys stored in memory.

The security impact of CVE-2026-71498 is categorized as an information disclosure vulnerability with a CVSS v3.1 base score of 5.1. The confidentiality impact is rated as low because the leakage is limited to a maximum of three bytes per execution. However, because the vulnerability can be triggered repeatedly in a loop, an attacker can reconstruct larger memory segments over time.

In certain execution environments, reading past the boundaries of the heap allocation can trigger a segmentation fault or a memory access violation. This occurs if the out-of-bounds read crosses a memory page boundary into unmapped or protected address space. Under these conditions, the vulnerability can be leveraged to cause a denial-of-service (DoS) condition by crashing the Node.js process.

The vulnerability is local in scope because it requires interaction with a local instance of the node-re2 library. However, if a network-facing Node.js application accepts raw binary uploads and passes them to node-re2, the vulnerability becomes exposable remotely. This expands the operational threat profile of the bug.

The primary remediation path for CVE-2026-71498 is upgrading the re2 npm package to version 1.26.1 or later. This version incorporates the overloaded, boundary-aware getUtf8CharSize checks which mitigate the out-of-bounds reading behavior across all affected native source files.

If upgrading the dependency is not immediately feasible, developers can implement an input sanitation workaround. Before passing any raw Node.js Buffer to a node-re2 function, convert it to a standard JavaScript UTF-8 string. This forces the V8 engine to serialize the input and discard or replace truncated multi-byte characters safely.

// Mitigation wrapper example
function safeReplace(re2Instance, rawBuffer, replacement) {
    // Converts buffer to string, neutralizing truncated multi-byte characters
    const sanitizedInput = rawBuffer.toString('utf8');
    return re2Instance.replace(sanitizedInput, replacement);
}

Organizations should also verify their dependency trees to ensure transitive dependencies utilizing node-re2 are identified and updated. Static analysis tools and software bill of materials (SBOM) scanning can help isolate legacy versions of the package.