# What changed in re2

> 4 changes in re2 1 from its official release notes, upgrade guides and advisories: 4 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/re2/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## re2 1

### Security

- node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript (1.26.1) — [security advisory](https://github.com/advisories/GHSA-J4R3-HG7J-8CHG)
- re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) (1.25.2) — [security advisory](https://github.com/advisories/GHSA-6HXR-MR5R-9836)
- re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS) (1.25.2) — [security advisory](https://github.com/advisories/GHSA-FF84-5F28-78QJ)
- node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length (1.25.1) — [security advisory](https://github.com/advisories/GHSA-8HCV-X26H-MCGP)