{"schema":"threatline.record/2","record":{"id":"CVE-2026-106074","aliases":[],"summary":"A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-sn","details":"A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.\n\nIf any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","categories":["Runtimes & languages"],"product":"node","vendor":"nodejs","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106074","source_modified_at":"2026-10-23T16:15:05.829Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"node","vendor":"nodejs","versions":[{"version":"22.23.3","status":"affected","lessThanOrEqual":"22.23.3","versionType":"semver"},{"version":"24.22.0","status":"affected","lessThanOrEqual":"24.22.0","versionType":"semver"},{"version":"26.12.0","status":"affected","lessThanOrEqual":"26.12.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T16:15:05.829Z","modified_at":"2026-10-23T16:15:05.829Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-106074","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T16:15:05.829Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T16:15:05.829Z","content_hash":"9b06b44f12d76c0501e36054d2fb1ca90a61465473eba4dfcd88143580f7f2ab"}}