The vulnerability resides in the re2 Node.js bindings, where an attacker can manipulate the lastIndex property with a non‑ASCII subject. The library validates lastIndex against the UTF‑8 byte length of the input but uses it as a UTF‑16 offset in exec, test, match, replace, and split. This mismatch allows an out‑of‑bounds heap read, leading to an uncatchable process crash and, in some cases, limited disclosure of heap contents. The flaw is a classic out‑of‑bounds read identified as CWE‑125 and results in a denial of service that cannot be recovered by application code.

The affected software is the node‑re2 package provided by uhop, specifically any installation earlier than release 1.25.2. Users running v1.24.x, 1.25.0, or 1.25.1 are vulnerable. The fix is delivered in the 1.25.2 release. No other vendors or product versions are listed as affected.

The CVSS score of 5.7 indicates moderate severity. The EPSS score is reported as less than 1 %, suggesting low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, and the public exploit material is limited to the GitHub commit and advisory. The exploit path requires an attacker to supply input that sets lastIndex on a non‑ASCII subject; this can be achieved through web forms, APIs, or any mechanism that passes regular‑expression inputs from untrusted sources. Once triggered, the process terminates unexpectedly, causing service disruption.