re2 1.25.1 → 1.26.0

package/README.md

@@ -20,7 +20,7 @@ It also provides `String`-based regular expression methods. The constructor acce
 It can work with [Node.js Buffers](https://nodejs.org/api/buffer.html) directly, reducing overhead and making processing of long files fast.
 
 The project is a C++ addon built with [nan](https://github.com/nodejs/nan). It cannot be used in web browsers.
-All documentation is in this README and in the [wiki](https://github.com/uhop/node-re2/wiki).
+All documentation is in this README and in the [wiki](https://github.com/uhop/node-re2/wiki) — browse the [index](https://github.com/uhop/node-re2/wiki/Home), or [search it](https://uhop.github.io/wiki-search/app/?wiki=uhop/node-re2) by name.
 
 ## Why use node-re2?
 
@@ -284,9 +284,9 @@ and GitHub's official [announcement of the npm v12 breaking changes](https://git
 
 ### Precompiled artifacts
 
-The [install script](https://github.com/uhop/install-artifact-from-github/blob/master/bin/install-from-cache.js) attempts to download a prebuilt artifact from GitHub Releases. Override the download location with the `RE2_DOWNLOAD_MIRROR` environment variable.
+The [install script](https://github.com/uhop/install-artifact-from-github/blob/master/bin/install-from-cache.js) attempts to download a prebuilt artifact from GitHub Releases. A download from GitHub is [verified](https://github.com/uhop/install-artifact-from-github/wiki/Verifying-artifacts) against the SHA-256 hashes pinned in this package's `artifactHashes` field before it is used — a binary that is not byte-for-byte the one published is rejected. Override the download location with the `RE2_DOWNLOAD_MIRROR` environment variable (a mirror serves your own builds and is not hash-checked). To skip the download entirely and always build from source, set `RE2_DOWNLOAD_FORCE_BUILD` to a non-empty value.
 
-If the download fails, the script builds RE2 locally using [node-gyp](https://github.com/nodejs/node-gyp).
+If the download fails or is rejected, the script builds RE2 locally using [node-gyp](https://github.com/nodejs/node-gyp).
 
 ## How to use
 
@@ -436,7 +436,9 @@ Tables are baked in at build time from Unicode 17.0. To target a newer Unicode v
 
 ## Release history
 
-- 1.25.1 *Security fix (GHSA-8hcv-x26h-mcgp): a global `replace()` using an output-amplifying template (`$'` or `` $` ``) on very large input could exceed V8's maximum string length and abort the whole process. It now throws a catchable `RangeError`, matching the built-in engine.*
+- 1.26.0 *Verified prebuilt downloads. Thx, [ataberk-xyz](https://github.com/ataberk-xyz).*
+- 1.25.2 *Two DoS security fixes: a global `match()` with an empty-matchable pattern (`a*`, `(?:)`, …) no longer loops forever exhausting memory (GHSA-6hxr-mr5r-9836), and an out-of-range `lastIndex` on a non-ASCII subject no longer reads past the buffer and crashes (GHSA-ff84-5f28-78qj). Both now match the built-in engine. Thx, [ataberk-xyz](https://github.com/ataberk-xyz).*
+- 1.25.1 *Security fix (GHSA-8hcv-x26h-mcgp): a global `replace()` using an output-amplifying template (`$'` or `` $` ``) on very large input could exceed V8's maximum string length and abort the whole process. It now throws a catchable `RangeError`, matching the built-in engine. Thx, [ataberk-xyz](https://github.com/ataberk-xyz).*
 - 1.25.0 *Full Unicode 17.0.0 property classes (Fixes #226). New `maxMem` option for `RE2.Set`. Faster matching on pure-ASCII inputs. Narrowed Node support — drops Node 25.x and older patch releases.*
 - 1.24.1 *Support for Node 22, 24, 26 + precompiled binaries.*
 - 1.24.0 *Fixed multi-threaded crash in worker threads (#235). Added named import: `import {RE2} from 're2'`. Added CJS test. Updated docs and dependencies.*

package/lib/addon.cc

@@ -197,10 +197,13 @@ const StrVal &WrappedRE2::prepareArgument(const v8::Local<v8::Value> &arg, bool
 	auto isolate = v8::Isolate::GetCurrent();
 
 	auto s = t.ToLocalChecked();
-	auto argLength = utf8Length(s, isolate);
-	// Pure ASCII iff the UTF-16 length (s->Length(), O(1)) equals the UTF-8
-	// byte length: any non-ASCII char makes the byte count strictly larger.
-	bool isAscii = static_cast<size_t>(s->Length()) == argLength;
+	// length validation walks UTF-16 code units, so lastIndex must be bounded by
+	// the UTF-16 length (s->Length(), O(1)) — not the UTF-8 byte length, which is
+	// larger for non-ASCII and would let an out-of-range lastIndex read past the buffer.
+	auto argLength = static_cast<size_t>(s->Length());
+	// Pure ASCII iff the UTF-16 length equals the UTF-8 byte length: any
+	// non-ASCII char makes the byte count strictly larger.
+	bool isAscii = argLength == utf8Length(s, isolate);
 
 	auto buffer = node::Buffer::New(isolate, s).ToLocalChecked();
 	lastCache.Reset(buffer);
@@ -260,7 +263,7 @@ void StrVal::setIndex(size_t newIndex)
 		return;
 	}
 
-	byteIndex = index < newIndex ? getUtf16PositionByCounter(data, byteIndex, newIndex - index) : getUtf16PositionByCounter(data, 0, newIndex);
+	byteIndex = index < newIndex ? getUtf16PositionByCounter(data, size, byteIndex, newIndex - index) : getUtf16PositionByCounter(data, size, 0, newIndex);
 	index = newIndex;
 }
 

package/lib/match.cc

@@ -45,7 +45,16 @@ NAN_METHOD(WrappedRE2::Match)
 		while (re2->regexp.Match(str, byteIndex, str.size, anchor, &match, 1))
 		{
 			groups.push_back(match);
-			byteIndex = match.data() - str.data + match.size();
+			size_t offset = match.data() - str.data;
+			if (match.size())
+			{
+				byteIndex = offset + match.size();
+			}
+			else
+			{
+				// zero-width match: advance one code point or the loop never terminates
+				byteIndex = offset + (offset < str.size ? getUtf8CharSize(str.data[offset]) : 1);
+			}
 		}
 
 		if (groups.empty())

package/lib/wrapped_re2.h

@@ -261,9 +261,9 @@ inline void writeUtf8(v8::Local<v8::String> s, v8::Isolate *isolate, char *buffe
 
 #endif
 
-inline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n)
+inline size_t getUtf16PositionByCounter(const char *data, size_t size, size_t from, size_t n)
 {
-	for (; n > 0; --n)
+	for (; n > 0 && from < size; --n)
 	{
 		size_t s = getUtf8CharSize(data[from]);
 		from += s;
@@ -271,5 +271,5 @@ inline size_t getUtf16PositionByCounter(const char *data, size_t from, size_t n)
 			--n; // this utf8 character will take two utf16 characters
 				 // the decrement above is protected to avoid an overflow of an unsigned integer
 	}
-	return from;
+	return from > size ? size : from;
 }

package/llms-full.txt

@@ -18,7 +18,7 @@
 npm install re2
 ```
 
-Prebuilt native binaries are downloaded automatically. Falls back to building from source via node-gyp if no prebuilt is available.
+Prebuilt native binaries are downloaded automatically and verified against SHA-256 hashes pinned in re2's `package.json` (`artifactHashes`). Falls back to building from source via node-gyp if no prebuilt is available or verification fails. Set `RE2_DOWNLOAD_FORCE_BUILD` to a non-empty value to always build from source.
 
 Both paths run in re2's install script. Under npm 12+ defaults (July 2026), install scripts require approval in the consuming project's `package.json`: run `npm pkg set allowScripts.re2=true --json` before `npm install re2`, otherwise the install fails with `ESTRICTALLOWSCRIPTS`. npm 11.16+ runs the script but prints a warning until approved.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "re2",
-  "version": "1.25.1",
+  "version": "1.26.0",
   "description": "Bindings for RE2: fast, safe alternative to backtracking regular expression engines.",
   "homepage": "https://github.com/uhop/node-re2",
   "bugs": "https://github.com/uhop/node-re2/issues",
@@ -17,7 +17,7 @@
     "vendor"
   ],
   "dependencies": {
-    "install-artifact-from-github": "^1.6.0",
+    "install-artifact-from-github": "^1.7.0",
     "nan": "^2.27.0",
     "node-gyp": "^13.0.0"
   },
@@ -35,7 +35,8 @@
     "test:seq": "tape6-seq --flags FO",
     "test:proc": "tape6-proc --flags FO",
     "save-to-github": "save-to-github-cache --artifact build/Release/re2.node",
-    "install": "install-from-cache --artifact build/Release/re2.node --host-var RE2_DOWNLOAD_MIRROR --skip-path-var RE2_DOWNLOAD_SKIP_PATH --skip-ver-var RE2_DOWNLOAD_SKIP_VER || node-gyp -j max rebuild",
+    "prepublishOnly": "hash-github-cache --write",
+    "install": "install-from-cache --artifact build/Release/re2.node --host-var RE2_DOWNLOAD_MIRROR --skip-path-var RE2_DOWNLOAD_SKIP_PATH --skip-ver-var RE2_DOWNLOAD_SKIP_VER --force-build-var RE2_DOWNLOAD_FORCE_BUILD || node-gyp -j max rebuild",
     "verify-build": "node scripts/verify-build.js",
     "build:dev": "node-gyp -j max build --debug",
     "build": "node-gyp -j max build",
@@ -71,5 +72,31 @@
       "/tests/test-*.*js",
       "/tests/test-*.*ts"
     ]
+  },
+  "artifactHashes": {
+    "darwin-arm64-127": "sha256:ee6ab29e4827d1373145cfb75ef16584fa62aa4231f4d0cb6563d8f17e9562ba",
+    "darwin-arm64-137": "sha256:1c7092bd5b422c40f54c3d7dc34f5907285a0cd44ff4d638b862d84754d28147",
+    "darwin-arm64-147": "sha256:7e0ed56cc8c9041ba01227c3cb6baa976eaf5fd6f7eaf78064dcdd22b0e2e13d",
+    "darwin-x64-127": "sha256:2eff49ac19346b316fc19d6d99752eefac50a68d52882f9b449ee75937f7ef11",
+    "darwin-x64-137": "sha256:a034c96ec3bff397bc5e5f629f0c79f72c42aac91e3c234424d09ec2ba6d55f0",
+    "darwin-x64-147": "sha256:1772726792f2171a77bf5b5186612ce58a36be349cc6e5191986cd66925bbd65",
+    "linux-arm64-127": "sha256:11953057e63ba205c1d27b4145955c4f671d5b086bb98f7a2309c689639c8533",
+    "linux-arm64-137": "sha256:3b3920e2cce296fc75f9e1a3a70940d1ed9858ffc525aae03a897e61e75bba87",
+    "linux-arm64-147": "sha256:94938e8a5f9cbcd4ecde45d6b29fc526a19b2db1e8e7fb3aa280a4a58fc1bf0e",
+    "linux-musl-arm64-127": "sha256:51125be7c782612e89ed07cf3b695e7de63953c272f51be321ecbf170c258389",
+    "linux-musl-arm64-137": "sha256:34c78f56c986a0b2eff017dd173c5280531df70512dbec0cd33915c01ad42cd1",
+    "linux-musl-arm64-147": "sha256:fbf80ece0901a242191d9d26a18664cad8ba9785e141990deb04e6efc8665af3",
+    "linux-musl-x64-127": "sha256:569cc2d01e26e299a0f3d719f67603442e8e2045315ca2cac995504c1480fe99",
+    "linux-musl-x64-137": "sha256:89991ff4439e93b27539c0d81c17d05e5752814996464c835d2c646e785cecea",
+    "linux-musl-x64-147": "sha256:121e9d5f7af6f75b4a1d2b3bab514f514c7d93101e8eb992bd3e9fb2765f857d",
+    "linux-x64-127": "sha256:3218e8a6daba6d70e525668c76d9a955d383c45266e49c52fb716828e9bf1771",
+    "linux-x64-137": "sha256:a0a0e9a261625f7a982851d3f069dd7f3a370399f5be90b1922835ac6bf66be8",
+    "linux-x64-147": "sha256:140286223194fe98650a72da7de8f893cd51b72f607c401f62d7d5c860e2e992",
+    "win32-arm64-127": "sha256:cb763db7c2a21ac4557946df9b0239a3e51db8b7fca7adb7d74adb4317e846b7",
+    "win32-arm64-137": "sha256:469db40cd5ad51f16652d3d122e37ea4e448dd43691cd3f935905e462f0634df",
+    "win32-arm64-147": "sha256:8c9505f8e0a85c437163bbbc10556e8fa4938d03dba063d4516ae34301f46020",
+    "win32-x64-127": "sha256:c97d9a0ab350720a01e367d62956b5f85d645613fcb71b5047b41a1806f6d609",
+    "win32-x64-137": "sha256:0d729f3b2e965fad8c1cec2f16dd8b4adcc7d55b80580d3ec96b5a56ef0c443b",
+    "win32-x64-147": "sha256:425fa904163218fd1f96692838a04955b3fd148604c4e455dc8a17527e5c6717"
   }
 }