re2 1.25.0 → 1.25.2

package/README.md

@@ -251,13 +251,7 @@ See the wiki for notes on [yarn](https://github.com/uhop/node-re2/wiki/Using-wit
 
 ### Supported Node.js versions
 
-`re2` supports the Node.js versions declared in its `engines` field:
-
-```
-^22.22.2 || ^24.15.0 || >=26.0.0
-```
-
-As of 1.25.0 this range was narrowed to mirror [`node-gyp`](https://github.com/nodejs/node-gyp) 13, which `re2` builds with (and which fixes a Node 26 build on Windows): **Node 25.x and the older 22.0–22.22.1 / 24.0–24.14 patch ranges are no longer supported.** Use a current release of an active line — Node 22 (≥ 22.22.2), 24 (≥ 24.15.0), or 26 and later.
+`re2` supports every non-EOL Node.js release — current and active LTS lines. As a native (`nan`) addon it runs on Node.js only, not Bun or Deno. The authoritative supported range is the `engines` field in `package.json`; it also pins the minimum patch releases the build toolchain ([`node-gyp`](https://github.com/nodejs/node-gyp) 13) requires. Check `engines` for the exact floor rather than a version repeated here.
 
 ### Install scripts (npm 12+)
 
@@ -442,6 +436,8 @@ Tables are baked in at build time from Unicode 17.0. To target a newer Unicode v
 
 ## Release history
 
+- 1.25.2 *Two DoS security fixes: a global `match()` with an empty-matchable pattern (`a*`, `(?:)`, …) no longer loops forever exhausting memory (GHSA-6hxr-mr5r-9836), and an out-of-range `lastIndex` on a non-ASCII subject no longer reads past the buffer and crashes (GHSA-ff84-5f28-78qj). Both now match the built-in engine. Thx, [ataberk-xyz](https://github.com/ataberk-xyz).*
+- 1.25.1 *Security fix (GHSA-8hcv-x26h-mcgp): a global `replace()` using an output-amplifying template (`$'` or `` $` ``) on very large input could exceed V8's maximum string length and abort the whole process. It now throws a catchable `RangeError`, matching the built-in engine. Thx, [ataberk-xyz](https://github.com/ataberk-xyz).*
 - 1.25.0 *Full Unicode 17.0.0 property classes (Fixes #226). New `maxMem` option for `RE2.Set`. Faster matching on pure-ASCII inputs. Narrowed Node support — drops Node 25.x and older patch releases.*
 - 1.24.1 *Support for Node 22, 24, 26 + precompiled binaries.*
 - 1.24.0 *Fixed multi-threaded crash in worker threads (#235). Added named import: `import {RE2} from 're2'`. Added CJS test. Updated docs and dependencies.*

package/lib/addon.cc

@@ -197,10 +197,13 @@ const StrVal &WrappedRE2::prepareArgument(const v8::Local<v8::Value> &arg, bool
 	auto isolate = v8::Isolate::GetCurrent();
 
 	auto s = t.ToLocalChecked();
-	auto argLength = utf8Length(s, isolate);
-	// Pure ASCII iff the UTF-16 length (s->Length(), O(1)) equals the UTF-8
-	// byte length: any non-ASCII char makes the byte count strictly larger.
-	bool isAscii = static_cast<size_t>(s->Length()) == argLength;
+	// length validation walks UTF-16 code units, so lastIndex must be bounded by
+	// the UTF-16 length (s->Length(), O(1)) — not the UTF-8 byte length, which is
+	// larger for non-ASCII and would let an out-of-range lastIndex read past the buffer.
+	auto argLength = static_cast<size_t>(s->Length());
+	// Pure ASCII iff the UTF-16 length equals the UTF-8 byte length: any
+	// non-ASCII char makes the byte count strictly larger.
+	bool isAscii = argLength == utf8Length(s, isolate);
 
 	auto buffer = node::Buffer::New(isolate, s).ToLocalChecked();
 	lastCache.Reset(buffer);
@@ -260,7 +263,7 @@ void StrVal::setIndex(size_t newIndex)
 		return;
 	}
 
-	byteIndex = index < newIndex ? getUtf16PositionByCounter(data, byteIndex, newIndex - index) : getUtf16PositionByCounter(data, 0, newIndex);
+	byteIndex = index < newIndex ? getUtf16PositionByCounter(data, size, byteIndex, newIndex - index) : getUtf16PositionByCounter(data, size, 0, newIndex);
 	index = newIndex;
 }
 

package/lib/match.cc

@@ -45,7 +45,16 @@ NAN_METHOD(WrappedRE2::Match)
 		while (re2->regexp.Match(str, byteIndex, str.size, anchor, &match, 1))
 		{
 			groups.push_back(match);
-			byteIndex = match.data() - str.data + match.size();
+			size_t offset = match.data() - str.data;
+			if (match.size())
+			{
+				byteIndex = offset + match.size();
+			}
+			else
+			{
+				// zero-width match: advance one code point or the loop never terminates
+				byteIndex = offset + (offset < str.size ? getUtf8CharSize(str.data[offset]) : 1);
+			}
 		}
 
 		if (groups.empty())

package/lib/replace.cc

@@ -315,7 +315,13 @@ inline Nan::Maybe<std::string> replace(
 			const auto data = item.data();
 			if (data)
 			{
-				argv.push_back(Nan::CopyBuffer(data, item.size()).ToLocalChecked());
+				auto buffer = Nan::CopyBuffer(data, item.size());
+				if (buffer.IsEmpty())
+				{
+					Nan::ThrowRangeError("Invalid string length");
+					return Nan::Nothing<std::string>();
+				}
+				argv.push_back(buffer.ToLocalChecked());
 			}
 			else
 			{
@@ -332,7 +338,13 @@ inline Nan::Maybe<std::string> replace(
 			const auto data = item.data();
 			if (data)
 			{
-				argv.push_back(Nan::New(data, item.size()).ToLocalChecked());
+				auto text = Nan::New(data, item.size());
+				if (text.IsEmpty())
+				{
+					Nan::ThrowRangeError("Invalid string length");
+					return Nan::Nothing<std::string>();
+				}
+				argv.push_back(text.ToLocalChecked());
 			}
 			else
 			{
@@ -551,8 +563,21 @@ NAN_METHOD(WrappedRE2::Replace)
 
 	if (replacee.isBuffer)
 	{
-		info.GetReturnValue().Set(Nan::CopyBuffer(result.data(), result.size()).ToLocalChecked());
+		auto buffer = Nan::CopyBuffer(result.data(), result.size());
+		if (buffer.IsEmpty())
+		{
+			Nan::ThrowRangeError("Invalid string length");
+			return;
+		}
+		info.GetReturnValue().Set(buffer.ToLocalChecked());
+		return;
+	}
+	// over-max-length result -> empty MaybeLocal; ToLocalChecked() would abort()
+	auto text = Nan::New(result);
+	if (text.IsEmpty())
+	{
+		Nan::ThrowRangeError("Invalid string length");
 		return;
 	}
-	info.GetReturnValue().Set(Nan::New(result).ToLocalChecked());
+	info.GetReturnValue().Set(text.ToLocalChecked());
 }

package/lib/wrapped_re2.h

@@ -261,9 +261,9 @@ inline void writeUtf8(v8::Local<v8::String> s, v8::Isolate *isolate, char *buffe
 
 #endif
 
-inline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n)
+inline size_t getUtf16PositionByCounter(const char *data, size_t size, size_t from, size_t n)
 {
-	for (; n > 0; --n)
+	for (; n > 0 && from < size; --n)
 	{
 		size_t s = getUtf8CharSize(data[from]);
 		from += s;
@@ -271,5 +271,5 @@ inline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n)
 			--n; // this utf8 character will take two utf16 characters
 				 // the decrement above is protected to avoid an overflow of an unsigned integer
 	}
-	return from;
+	return from > size ? size : from;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "re2",
-  "version": "1.25.0",
+  "version": "1.25.2",
   "description": "Bindings for RE2: fast, safe alternative to backtracking regular expression engines.",
   "homepage": "https://github.com/uhop/node-re2",
   "bugs": "https://github.com/uhop/node-re2/issues",
@@ -22,11 +22,11 @@
     "node-gyp": "^13.0.0"
   },
   "devDependencies": {
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.0.1",
     "@unicode/unicode-17.0.0": "^1.6.17",
     "nano-benchmark": "^1.0.16",
     "prettier": "^3.8.4",
-    "tape-six": "^1.10.1",
+    "tape-six": "^1.14.0",
     "tape-six-proc": "^1.3.1",
     "typescript": "^6.0.3"
   },
@@ -65,8 +65,6 @@
   ],
   "author": "Eugene Lazutkin <eugene.lazutkin@gmail.com> (https://lazutkin.com/)",
   "funding": "https://github.com/sponsors/uhop",
-  "llms": "https://raw.githubusercontent.com/uhop/node-re2/master/llms.txt",
-  "llmsFull": "https://raw.githubusercontent.com/uhop/node-re2/master/llms-full.txt",
   "license": "BSD-3-Clause",
   "tape6": {
     "tests": [