CVE-2026-71498

MediumCVSS 5.1/10Last modified Oct 24, 2026

Description

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 6, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-71506.3A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate_fa CVE-2026-715025.1CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimite CVE-2026-715036.1Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type re CVE-2026-715048.1Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creat CVE-2026-715057.1Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that CVE-2026-715068.1Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated a CVE-2026-715076.5Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that all CVE-2026-715086.5Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user CVE-2026-715096.5Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authentic CVE-2026-71518.8A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipu CVE-2026-715106.5Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read right CVE-2026-715116.5Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with mem