AIKIDO-2026-447516
regex is vulnerable to Out-of-bounds Write
56
Medium Risk
This Affects:
regexTL;DR
The regex module contains memory-safety flaws in its pattern compiler and native matching engine that are reachable through specially crafted regular expressions. Compiling a conditional pattern whose emptiness is misjudged can trigger a heap out-of-bounds write while the compiled program is built. Fuzzy matching can also reuse a stale required-string cache position after the search slice is narrowed, and basic_match() can let the scan boundary move past the intended slice limits, causing out-of-bounds access. The fix corrects the emptiness check, invalidates the cached required-string position when the slice changes, and clamps the scan boundaries.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application compiles or matches regular expressions derived from untrusted input.
Background info
regex is vulnerable to Out-of-bounds Write in versions 2015.10.01 - 2026.7.19.
How to fix this
Upgrade the regex library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.