CyberRota Analysis
AI-GeneratedThe node-re2 library for Node.js is vulnerable to an out-of-bounds read due to improper handling of truncated multi-byte UTF-8 sequences in Buffers prior to version 1.26.1. This flaw could lead to the disclosure of adjacent memory contents, posing a risk to applications that utilize this library for regular expression processing. Developers using affected versions should prioritize upgrading to version 1.26.1 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.