The node-re2 package, which provides Node.js bindings for Google's RE2 regular expression engine, improperly validates the lastIndex property by comparing it against the UTF-8 byte length of the input string but then uses it as a UTF-16 code-unit offset in functions like exec, test, match, replace, and split. This mismatch allows an attacker-controlled lastIndex on non-ASCII input to trigger an out-of-bounds heap read, leading to a process crash that cannot be caught and may disclose limited heap information. The vulnerability is identified as CWE-125 (Out-of-bounds Read) and has a CVSS v3.1 score of 5.7 (medium severity). The issue is resolved in node-re2 version 1.25.2.

Exploitation of this vulnerability can cause an uncatchable crash of the Node.js process using node-re2, resulting in denial of service. Additionally, limited heap information disclosure may occur, potentially aiding further attacks. There is no indication of privilege escalation or code execution. The attack requires local access (AV:L) and high attack complexity (AC:H), with no privileges or user interaction required.

Upgrade node-re2 to version 1.25.2 or later, where this vulnerability is fixed. Since no official patch links or advisories are provided, users should verify the version in use and update accordingly. Patch status is confirmed by the description stating the issue is fixed in 1.25.2. No alternative mitigations are indicated.