node-re2 - Debian Package Tracker

general

source: node-re2 (main)
version: 1.26.1+~cs1.7.0-1
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Jérémy Lal [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.15.9+~cs1.8.18-1
o-o-sec: 1.15.9+~cs1.8.18-1+deb11u1
oldstable: 1.18.0+~cs2.13.8-1
stable: 1.21.4+~cs2.13.13-2
testing: 1.25.0+~cs1.6.0-2
unstable: 1.26.1+~cs1.7.0-1

versioned links

1.15.9+~cs1.8.18-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.15.9+~cs1.8.18-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.18.0+~cs2.13.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.21.4+~cs2.13.13-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.25.0+~cs1.6.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.26.1+~cs1.7.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

node-re2

action needed

4 security issues in trixie high

There are 4 open security issues in trixie.

2 important issues:

CVE-2026-67550: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
CVE-2026-68499: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.

2 issues left for the package maintainer to handle:

CVE-2026-71430: (needs triaging) node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.
CVE-2026-71498: (needs triaging) node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-07-31 Last update: 2026-08-08 18:30

4 security issues in forky high

There are 4 open security issues in forky.

4 important issues:

CVE-2026-67550: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
CVE-2026-68499: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.
CVE-2026-71430: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.
CVE-2026-71498: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

Created: 2026-07-31 Last update: 2026-08-08 18:30

4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:

CVE-2026-67550: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
CVE-2026-68499: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.
CVE-2026-71430: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.
CVE-2026-71498: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

Created: 2026-07-31 Last update: 2026-08-08 18:30

4 security issues in bookworm high

There are 4 open security issues in bookworm.

4 important issues:

CVE-2026-67550: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
CVE-2026-68499: re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.
CVE-2026-71430: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.
CVE-2026-71498: node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

Created: 2026-07-31 Last update: 2026-08-08 18:30

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 3c5ff49475c9169bbdf9e983c638131aa1e74d0b
Author: Xavier Guimard <yadd@debian.org>
Date:   Sat Aug 8 10:55:36 2026 +0200

    Update copyright years

https://salsa.debian.org/api/v4/projects/js-team%2Fnode-re2 API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-08-08 Last update: 2026-08-08 15:30

testing migrations

excuses:
- Migrates after: nodejs
- Migration status for node-re2 (1.25.0+~cs1.6.0-2 to 1.26.1+~cs1.7.0-1): Waiting for test results or another package, or too young (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Autopkgtest for node-ajv/8.20.0~ds+~cs7.1.3-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for node-re2/1.26.1+~cs1.7.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Too young, only 2 of 5 days old
- ∙ ∙ Depends: node-re2 nodejs (not considered)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/n/node-re2.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-08-08] Accepted node-re2 1.26.1+~cs1.7.0-1 (source) into unstable (Xavier Guimard)
[2026-06-25] node-re2 1.25.0+~cs1.6.0-2 MIGRATED to testing (Debian testing watch)
[2026-06-20] Accepted node-re2 1.25.0+~cs1.6.0-2 (source) into unstable (Xavier Guimard)
[2026-06-20] Accepted node-re2 1.25.0+~cs1.6.0-1 (source) into unstable (Xavier Guimard)
[2026-03-26] node-re2 1.23.3+~cs1.3.5-1 MIGRATED to testing (Debian testing watch)
[2026-03-24] Accepted node-re2 1.23.3+~cs1.3.5-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-08-16] node-re2 1.22.1+~cs1.3.5-1 MIGRATED to testing (Debian testing watch)
[2025-08-10] Accepted node-re2 1.22.1+~cs1.3.5-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2025-05-01] Accepted node-re2 1.15.9+~cs1.8.18-1+deb11u1 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2024-08-29] node-re2 1.21.4+~cs2.13.13-2 MIGRATED to testing (Debian testing watch)
[2024-08-26] Accepted node-re2 1.21.4+~cs2.13.13-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2024-08-25] Accepted node-re2 1.21.4+~cs2.13.13-1 (source) into experimental (Yadd) (signed by: Xavier Guimard)
[2024-05-31] node-re2 1.20.12+~cs2.13.13-1 MIGRATED to testing (Debian testing watch)
[2024-05-29] Accepted node-re2 1.20.12+~cs2.13.13-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2024-05-02] node-re2 1.20.10+~cs2.13.13-1 MIGRATED to testing (Debian testing watch)
[2024-03-21] Accepted node-re2 1.20.10+~cs2.13.13-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2023-12-21] node-re2 1.19.2+~cs2.13.13-1 MIGRATED to testing (Debian testing watch)
[2023-12-17] Accepted node-re2 1.19.2+~cs2.13.13-1 (source) into unstable (Jérémy Lal)
[2022-12-16] node-re2 1.18.0+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2022-12-13] Accepted node-re2 1.18.0+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-11-27] node-re2 1.17.8+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2022-11-25] Accepted node-re2 1.17.8+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-06-20] node-re2 1.17.7+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2022-06-14] Accepted node-re2 1.17.7+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-02-28] node-re2 1.17.4+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2022-02-25] Accepted node-re2 1.17.4+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-01-30] node-re2 1.17.3+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2022-01-27] Accepted node-re2 1.17.3+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-12-31] node-re2 1.17.2+~cs2.13.8-1 MIGRATED to testing (Debian testing watch)
[2021-12-29] Accepted node-re2 1.17.2+~cs2.13.8-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.25.0+~cs1.6.0-2