CVE-2026-71498

CVE-2026-71498 is a truncated UTF-8 sequence triggering an out-of-bounds read in node-re2's native binding layer. The CVSS 5.1 score reflects an OOB read from native code into adjacent heap memory — a memory disclosure primitive, not code execution. That distinction matters: this is the kind of vulnerability that chains. It leaks adjacent data that could include session tokens, environment variables, or heap metadata, and it lives in a component (regex validation) that sits in security-critical paths — input sanitization, auth token parsing, route matching. The EPSS score of 0.00156 is not a reliable indicator of risk here. EPSS models exploitation telemetry, CVE mentions, and honeypot observations — none of which capture library-level native binding vulnerabilities with no public exploit chain. An OOB read that serves as a first domino in a supply chain attack leaves no obvious artifacts and won't appear in any of those signals. Treat the EPSS floor as evidence of model blindness, not evidence of safety. The more serious question is transitive exposure. node-re2 is a performance dependency; it gets pulled in by libraries that wrap it for higher-level APIs. Direct download counts massively understate how many projects have this in their dependency tree — and worse, most of those projects have no mechanism to know they depend on native code at all. The JavaScript module system completely abstracts away the C boundary, so developers accept a memory-unsafe dependency without realizing it. What matters now: verify you don't transitively depend on node-re2 below version 1.26.1. If you do, upgrade — but treat the upgrade as a data point, not a closed case. The fix was a bounds check on truncated UTF-8 sequences, but that raises a question about every other encoding path in that native layer. Native addon authors frequently treat JavaScript Buffers as safe inputs without auditing edge-case encoding states. If the fix was surgical rather than structural, other encoding edge cases (CESU-8, WTF-8, overlong encodings) in the same code path remain unexplored. This is a recurring vulnerability class in Node.js native addons — three similar UTF-8 boundary bugs have appeared in the past six years, each scored low by EPSS, each patched surgically, each leaving the underlying assumption intact. Prioritize audit, not just patching. Instrument your observability stack to flag native addon memory access anomalies if possible, and flag this CVE in your dependency scanners as a transitive risk — not just a direct one.

Reviewed through automated stages and approved by a human before publication.