The issue lies in node‑re2’s WrappedRE2::Replace routine, which constructs replacement strings without checking the result size. When a template that amplifies output is used globally, the resulting string can grow quadratically and eventually surpass V8’s maximum string length. At that point the routine calls ToLocalChecked on an empty MaybeLocal, causing V8 to terminate the process uncatchably. This produces a denial of service by crashing the Node.js application and represents an unchecked return value weakness (CWE‑617) and an integer overflow/underflow risk (CWE‑131).

The vulnerability affects the node‑re2 library from uhop. All releases earlier than version 1.25.1 are susceptible.

The CVSS score of 6.2 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker with the ability to supply input to a Node.js application that uses node‑re2 can trigger the crash by providing a large replacement template. The exploit does not require elevated privileges; it only needs the attacker to influence the replace operation. Once activated, the application aborts uncatchably, resulting in a denial of service.