All vulnerabilities
CVE-2026-106074

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-sn

nodejs nodeRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
4.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 23 Oct 2026, 16:15 UTCPublishedCVE List
  2. 23 Oct 2026, 23:48 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot.

If any of these functions, or an API that relies on them such as URL.createObjectURL(), is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 randomInt() values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Text from CVE List

Affected versions 3

  • nodeaffected: 22.23.3 through 22.23.3CVE List
  • nodeaffected: 24.22.0 through 24.22.0CVE List
  • nodeaffected: 26.12.0 through 26.12.0CVE List

References 1