node-re2 is a Node.js binding for Google RE2. The vulnerability is an out-of-bounds heap read triggered when a Buffer that ends with an incomplete multi-byte UTF-8 character is passed to the replace or split functions. This causes the native code to read past the end of the Buffer, potentially disclosing adjacent heap memory to JavaScript and allowing an attacker to obtain sensitive data. The flaw is a classic CWE‑125 type buffer over-read.

The affected product is node-re2 by uhop. Versions earlier than 1.26.1 are vulnerable. Versions 1.26.1 and later contain the fix and are not affected.

The CVSS score of 5.1 indicates a moderate risk. Disclosures stemming from the out‑of‑bounds read are possible, but the exploitability depends on the attacker’s ability to supply malicious Buffers to the vulnerable functions. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is local and requires control over the data processed by the application. While it lacks remote code execution, the information disclosure could assist in further attacks if sensitive data is exposed.