These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-71498 is a medium-severity vulnerability in the node-re2 package, which provides RE2 regular expression bindings for Node.js. The issue arises from passing a Buffer with a truncated multi-byte UTF-8 sequence, potentially causing an out-of-bounds read and disclosure of adjacent memory contents. This vulnerability was fixed in version 1.26.1.
CVE-2026-71430 is a medium-severity vulnerability in the node-re2 package, which provides RE2 regular expression bindings for Node.js. The vulnerability occurs in the WrappedRE2::Replace function, causing a fatal process abort when replacement results exceed V8's maximum string length. Fixed in version 1.25.1. Defenders should assess exposure and prioritize upgrading to prevent potential process aborts. T [truncated]
The CVE-2026-68499 vulnerability affects re2 Node.js bindings, specifically versions prior to 1.25.2. This vulnerability is caused by an infinite loop in re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string, leading to unbounded native memory growth and potential memory exhaustion. The issue can be mitigated by upgrading to version 1.25.2 or later. Affected [truncated]