AIKIDO-2026-486417
re2 is vulnerable to Out-of-bounds Read
51
Medium Risk
This Affects:
re2TL;DR
The native layer infers a UTF-8 character's byte length from its lead byte alone, without checking how many bytes actually remain in the input. When a Buffer whose last byte is a multi-byte lead byte is passed to replace or split, the result builders read up to three bytes past the end of the buffer. Those adjacent heap bytes are copied into the returned Buffer, disclosing neighboring heap memory to JavaScript, and the read is repeatable so an attacker controlling Buffer input can sample heap contents incrementally. The fix clamps the inferred character size to the bytes actually remaining at every buffer-indexing read site.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass Buffer input rather than strings to the replace or split methods.
Background info
re2 is vulnerable to Out-of-bounds Read in versions 1.1.0 - 1.26.0.
How to fix this
Upgrade the re2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant