CVE-2026-67550 in the Node.js re2 binding has a CVSS 5.7 that badly misrepresents the actual threat. The score treats this as a moderate information disclosure issue, but the real impact is a deterministic, uncatchable process crash — and that's far more serious than the number suggests.
The bug is an encoding boundary mismatch. The code validates the lastIndex parameter against UTF-8 byte length, then applies it as a UTF-16 code-unit offset against the subject string. For ASCII strings these align perfectly, which is almost certainly why the bug went undetected — every test suite that exercises only ASCII characters passes without incident. But the moment a non-ASCII character enters the string, these two measures diverge. A lastIndex value that passes the UTF-8 validation check will always land past the buffer's logical end in UTF-16 terms, triggering an out-of-bounds read that terminates the Node.js process. Crucially, this crash cannot be caught. There is no try/catch that saves you — the process simply exits.
For any application where an attacker can control both the lastIndex value and the subject string being processed, this is an immediately exploitable denial-of-service vector. The conditions are trivially met: the lastIndex parameter flows through exec, test, match, replace, and split methods. A regex endpoint that accepts a subject string and an optional lastIndex value from user input has everything it needs to crash deterministically on the first non-ASCII character processed.
The fix corrected the encoding assumption rather than adding a boundary check — meaning the original code likely worked correctly for ASCII inputs and the mismatch crept in during some evolution of the string handling logic. This is worth investigating in the commit history because it signals whether this is a one-off mistake or evidence of systemic confusion about encoding boundaries in other re2 methods.
What you should do: audit any code paths where lastIndex or similar index parameters accepted from users flow into re2 operations. If you're processing user-supplied strings with any regex operation that exposes index-based searching, treat this as a P0 until patched — not because memory corruption is likely, but because a single non-ASCII character in the right position guarantees process termination with no recovery path. The CVSS framework's reliance on 'limited disclosure' as a severity anchor simply doesn't account for this class of bug where the crash is the feature, not a side effect.