TI-2026-47734 Aliases CVE-2026-67550 GHSA-ff84-5f28-78qj

Out-of-bounds read in uhop node-re2

MEDIUM 59CWE-125Published 2026-07-30 · Updated 2026-07-31

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: Low · None · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00161 5th percentileScored 2026-11-07

Fix Partial node-re2 (uhop): 1.25.2re2 (npm): 1.25.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
uhop	node-re2	before 1.25.2	1.25.2	Patch available	CNA
—	re2 (npm)	before 1.25.2	1.25.2	Patch available	GHSA-ff84-5f28-78qj

node-re2 Vendoruhop Affected before 1.25.2 Fixed in 1.25.2 Patch available CNA
re2 (npm) Vendor— Affected before 1.25.2 Fixed in 1.25.2 Patch available GHSA-ff84-5f28-78qj

Remediation

Fix · CNA node-re2 (uhop) Fixed in 1.25.2
Fix · GHSA-ff84-5f28-78qj re2 (npm) Fixed in 1.25.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-67550
2026-10-03 Alias added: GHSA-ff84-5f28-78qj

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-67550

Other 4

TI-2026-78913 Quadratic CPU use in stream-json FlexAssembler allows denial of service CVSS 3.1MEDIUM 6.2
TI-2026-65777 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk CVSS 3.1MEDIUM 6.2
TI-2026-50052 Reachable assertion in uhop node-re2 CVSS 3.1MEDIUM 6.2
TI-2026-50051 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small… CVSS 3.1MEDIUM 6.2
TI-2026-48273 Infinite loop in uhop node-re2 CVSS 3.1MEDIUM 6.2
TI-2026-65778 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects CVSS 3.1MEDIUM 5.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences