THREAT OPS › Threat News › [GHSA] GHSA-ff84-5f28-78qj (medium) — re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
[GHSA] GHSA-ff84-5f28-78qj (medium) — re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
GHSA-ff84-5f28-78qj Severity: medium CVE: CVE-2026-67550
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
## Summary
`re2` validates the user-settable `lastIndex` against the subject's **UTF-8 byte length** but then uses it as a **UTF-16 code-unit count** to walk the subject buffer, with no bounds
Indicators of compromise
- CVE-2026-67550cve
- addon.ccdomain
- accessors.ccdomain
- exec.ccdomain
Original source: https://github.com/advisories/GHSA-ff84-5f28-78qj