CVE-2026-71498: 
JavaScript 脆弱性の分析と軽減

CVE-2026-71498 is an out-of-bounds heap read vulnerability in node-re2, the RE2 regular expression bindings for Node.js. The flaw allows the native binding to read up to 3 bytes past the end of an allocated Buffer when the final bytes form a truncated (incomplete) multi-byte UTF-8 sequence, disclosing adjacent heap memory to JavaScript. All versions up to and including 1.26.0 are affected; the issue was reported on July 20, 2026, and fixed in version 1.26.1 released August 6, 2026. It carries a CVSS v3.1 base score of 5.1 (Medium) (GitHub Advisory, Security Advisory).

The root cause (CWE-125: Out-of-bounds Read) lies in the getUtf8CharSize() helper function in lib/wrapped_re2.h, which infers a UTF-8 character's byte length solely from its lead byte using a bitmask lookup — with no awareness of how many bytes actually remain in the input buffer. Because Buffer arguments are passed verbatim to the native layer (unlike strings, which are re-encoded into well-formed UTF-8), a Buffer ending in a multi-byte lead byte (e.g., 0xF0) causes callers to read 1–3 bytes past the buffer's end. Seven read sites were affected across lib/replace.cc, lib/split.cc, and lib/pattern.cc; four of these (in replace() and split()) copy the over-read bytes into the result returned to JavaScript, constituting an information disclosure. The trigger is deterministic and requires no heap grooming — a crafted two-byte Buffer such as Buffer.from([0x41, 0xF0]) reliably reproduces the issue (Security Advisory, Issue #272).

Successful exploitation results in disclosure of up to 3 bytes of adjacent heap memory per call to replace() or split(), returned directly to JavaScript. Because the read is repeatable and deterministic, an attacker who controls Buffer input and can observe output may incrementally sample heap contents, potentially exposing fragments of other in-memory buffers (e.g., credentials, keys, or sensitive application data). Integrity is not impacted, but availability is rated low due to the possibility of a fault if the buffer ends on a page boundary. Applications processing only string input or well-formed UTF-8 Buffers are not affected (GitHub Advisory).

A proof-of-concept demonstrating the vulnerability was included in the original bug report by researcher @OvOhao and is publicly available in the GitHub issue and security advisory. The exploit requires no privileges, no user interaction, and no special heap layout — the trigger is fully deterministic. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No in-the-wild exploitation or threat actor attribution has been reported (Security Advisory, Issue #272).

1. Identify target: Locate a Node.js application that uses the re2 npm package (versions ≤ 1.26.0) and accepts attacker-controlled input passed as a Buffer to replace(), split(), or the RE2 constructor.
2. Craft malicious Buffer: Construct a Buffer whose final byte is a multi-byte UTF-8 lead byte without its required continuation bytes — for example, Buffer.from([0x41, 0xF0]) (ASCII 'A' followed by a 4-byte UTF-8 lead).
3. Trigger the over-read: Pass the crafted Buffer as the subject or replacement argument to a vulnerable method:

   const RE2 = require('re2');
   new RE2('', 'g').replace(Buffer.from([0x41, 0xF0]), '');
   // Returns 5 bytes: 0x41 0xF0 + 3 bytes of adjacent heap memory

4. Observe output: Capture the returned Buffer; bytes beyond the original input length are adjacent heap contents. A lead byte of 0xC2 leaks 1 extra byte, 0xE2 leaks 2, and 0xF0 leaks 3.
5. Repeat for incremental disclosure: Call the method repeatedly with varying inputs or timing to sample different regions of heap memory, potentially recovering sensitive data from other buffers (Security Advisory, Issue #272).

• Application Behavior: replace() or split() calls returning Buffers longer than the input Buffer supplied — e.g., a 2-byte input yielding a 5-byte output — is a direct indicator of exploitation.
• Logs: Unexpected or anomalous output lengths logged by application-layer instrumentation around RE2 replace/split calls; errors such as SyntaxError: invalid UTF-8 when Buffer patterns ending in 0xC2, 0xE2, or 0xF0 are passed to the RE2 constructor.
• Code/Dependency Audit: Presence of re2 npm package at version ≤ 1.26.0 in package.json or node_modules; confirm with npm list re2.

Upgrade the re2 npm package to version 1.26.1 or later, which clamps the inferred character size to the bytes actually remaining at all seven affected read sites. If an immediate upgrade is not possible, two workarounds are available: (1) pass strings rather than Buffers to replace(), split(), and the RE2 constructor, since string input is always re-encoded into well-formed UTF-8; or (2) validate Buffer input before use with Buffer.compare(Buffer.from(buf.toString('utf8')), buf) === 0 and reject any Buffer that fails this check. The fix is O(1) and introduces no algorithmic complexity change (GitHub Advisory, Security Advisory).