Bug 2511704

Summary: CVE-2026-67550 re2: Denial of Service via out-of-bounds read [fedora-all]
Product: [Fedora] Fedora Reporter: Joel Chamberlain <jochambe>
Component: re2Assignee: Ben Beasley <code>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: rawhideCC: code, ekohlvan, tdawson
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["7b9edbcb-c8ff-4be2-8ab2-2507b44dd59d"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-08-05 19:05:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2173769    

Description Joel Chamberlain 2026-08-05 18:34:25 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
Comment 1 Ben Beasley 2026-08-05 19:05:51 UTC 
The CVE is for https://www.npmjs.com/package/re2 / https://github.com/uhop/node-re2, but the re2 package is https://github.com/google/re2 and does not include any JavaScript/NodeJS libraries.