< Back

CVE-2026-106074

Updated on 23 Oct 2026

Severity

4.8 Medium severity

Details

CVSS score
4.8
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot.

If any of these functions, or an API that relies on them such as URL.createObjectURL(), is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 randomInt() values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Details

Affected product:
AlmaLinux 9.2 ESU , Alpine Linux 3.23 , Alpine Linux 3.24 , Debian 10 , Debian 11 , Debian 12 , Debian 13 , EL 10 , EL 6 , EL 7 , EL 8 , EL 9 , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 18.04 , Ubuntu 20.04 , Ubuntu 22.04 , Ubuntu 24.04 , Ubuntu 26.04
Affected packages:
nodejs @ 16.20.2 (+115 more)

Fixes