Register | Log in

node-re2

Node.js bindings for RE2, a fast and safe regular expression engine

Choose email to subscribe with

general

source: node-re2 (main)
version: 1.26.1+~cs1.8.0-1
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Jérémy Lal [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.15.9+~cs1.8.18-1
o-o-sec: 1.15.9+~cs1.8.18-1+deb11u1
oldstable: 1.18.0+~cs2.13.8-1
stable: 1.21.4+~cs2.13.13-2
testing: 1.26.1+~cs1.8.0-1
unstable: 1.26.1+~cs1.8.0-1

versioned links

1.15.9+~cs1.8.18-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.15.9+~cs1.8.18-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.18.0+~cs2.13.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.21.4+~cs2.13.13-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.26.1+~cs1.8.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

node-re2

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://api.github.com/repos/uhop/node-re2/git/matching-refs/tags/ failed: 500 Can't connect to api.github.com:443 (Temporary failure in name resolution)

Created: 2026-10-17 Last update: 2026-10-18 16:31

4 security issues in bookworm high

There are 4 open security issues in bookworm.

4 important issues:

CVE-2026-67550: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
CVE-2026-68499: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.
CVE-2026-71430: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.
CVE-2026-71498: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

Created: 2026-07-31 Last update: 2026-09-01 22:00

4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:

CVE-2026-67550: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
CVE-2026-68499: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.
CVE-2026-71430: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.
CVE-2026-71498: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

Created: 2026-07-31 Last update: 2026-08-26 06:30

4 low-priority security issues in trixie low

There are 4 open security issues in trixie.

4 issues left for the package maintainer to handle:

CVE-2026-67550: (needs triaging) re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
CVE-2026-68499: (needs triaging) re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.
CVE-2026-71430: (needs triaging) node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.
CVE-2026-71498: (needs triaging) node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-07-31 Last update: 2026-09-01 22:00

testing migrations

This package will soon be part of the abseil-20260817 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[2026-08-26] node-re2 1.26.1+~cs1.8.0-1 MIGRATED to testing (Debian testing watch)
[2026-08-21] Accepted node-re2 1.26.1+~cs1.8.0-1 (source) into unstable (Xavier Guimard)
[2026-08-15] node-re2 1.26.1+~cs1.7.0-1 MIGRATED to testing (Debian testing watch)
[2026-08-08] Accepted node-re2 1.26.1+~cs1.7.0-1 (source) into unstable (Xavier Guimard)
[2026-06-25] node-re2 1.25.0+~cs1.6.0-2 MIGRATED to testing (Debian testing watch)
[2026-06-20] Accepted node-re2 1.25.0+~cs1.6.0-2 (source) into unstable (Xavier Guimard)
[2026-06-20] Accepted node-re2 1.25.0+~cs1.6.0-1 (source) into unstable (Xavier Guimard)
[2026-03-26] node-re2 1.23.3+~cs1.3.5-1 MIGRATED to testing (Debian testing watch)
[2026-03-24] Accepted node-re2 1.23.3+~cs1.3.5-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-08-16] node-re2 1.22.1+~cs1.3.5-1 MIGRATED to testing (Debian testing watch)
[2025-08-10] Accepted node-re2 1.22.1+~cs1.3.5-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-05-01] Accepted node-re2 1.15.9+~cs1.8.18-1+deb11u1 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2024-08-29] node-re2 1.21.4+~cs2.13.13-2 MIGRATED to testing (Debian testing watch)
[2024-08-26] Accepted node-re2 1.21.4+~cs2.13.13-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2024-08-25] Accepted node-re2 1.21.4+~cs2.13.13-1 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2024-05-31] node-re2 1.20.12+~cs2.13.13-1 MIGRATED to testing (Debian testing watch)
[2024-05-29] Accepted node-re2 1.20.12+~cs2.13.13-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2024-05-02] node-re2 1.20.10+~cs2.13.13-1 MIGRATED to testing (Debian testing watch)
[2024-03-21] Accepted node-re2 1.20.10+~cs2.13.13-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2023-12-21] node-re2 1.19.2+~cs2.13.13-1 MIGRATED to testing (Debian testing watch)
[2023-12-17] Accepted node-re2 1.19.2+~cs2.13.13-1 (source) into unstable (Jérémy Lal)
[2022-12-16] node-re2 1.18.0+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2022-12-13] Accepted node-re2 1.18.0+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-11-27] node-re2 1.17.8+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2022-11-25] Accepted node-re2 1.17.8+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-06-20] node-re2 1.17.7+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2022-06-14] Accepted node-re2 1.17.7+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-02-28] node-re2 1.17.4+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2022-02-25] Accepted node-re2 1.17.4+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-01-30] node-re2 1.17.3+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.26.1+~cs1.7.0-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing