unstale

npm / re2

re2

What changed in re2 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

4 security

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.8 on npm

re2 14 changes

Security 4

  • node-re2: Out-of-bounds heap read in replace/split via a Buffer ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

    1.26.1security advisory

  • re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

    1.25.2security advisory

  • re2: Out-of-bounds heap read in exec/test/match via attacker-influenced lastIndex on a non-ASCII subject → uncatchable process crash (DoS)

    1.25.2security advisory

  • node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

    1.25.1security advisory