Vulnpedia
← Search CVEs

CVE-2026-106074

MEDIUM 4.8

Published 2026-10-23 · Last modified 2026-10-23

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 25th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

4.8CVSS 3.0 · MEDIUM

  • ConfidentialityLow
  • IntegrityLow
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Nodejs

Products Node

Weakness (CWE)

  • CWE-330: Use of Insufficiently Random Values

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 67 vendor product statements; 35 omitted. Read the full vendor advisory.

  • nodejs as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-docs as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-npm as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-npm

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs24 as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs24

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs24-full-i18n as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs24-full-i18n

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs24-npm as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs24-npm

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs26.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs26?arch=src

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-nodemon.src (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-nodemon?arch=src&rpmmod=nodejs:24

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-nodemon (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-nodemon?rpmmod=nodejs:24

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-packaging.src (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-packaging?arch=src&rpmmod=nodejs:22

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-packaging (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-packaging?rpmmod=nodejs:22

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:24

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • npm (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:24

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • v8-13.6-devel (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/v8-13.6-devel?rpmmod=nodejs:22

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-full-i18n (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:26

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:22

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • npm (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:22

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • npm (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:26

    • workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
    • none available: Fix deferred
    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • hi/nodejs as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/nodejs?repository_url=registry.redhat.io/hi/nodejs

    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs20.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs20?arch=src

    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs22.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs22?arch=src

    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs24.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs24?arch=src

    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs25.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs25?arch=src

    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00
  • nodejs26.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs26?arch=src

    Red Hat · CVE-2026-106074 · Updated 2026-10-26T11:03:13+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate

All CVSS metrics

  • MEDIUM 4.8 v3.0 · CNA Primary
    CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
  • MEDIUM 4.8 v3.0 · NVD Secondary
    CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS