Live › vulnerability › CVE-2026-106074
Go to dashboardNode.js saves its random UUID and randomInt entropy caches into startup snapshots and single executable applications built with snapshots. Every process started from such a snapshot returns the same values until the cache refills, so identifiers can collide and be predicted from another process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only applications that use Node.js startup snapshots () or single executable applications built with , and that call the affected random APIs while the snapshot is being built. Ordinary Node.js processes that do not use snapshots are not described as affected by the sources.
--build-snapshotuseSnapshotNo product ranges from the sources yet.
node --version and compare against the fixed releases listed in the advisory.--build-snapshot or useSnapshot and check whether crypto.randomUUID(), crypto.randomUUIDv7(), crypto.randomInt() or URL.createObjectURL() run during snapshot construction.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot.
If any of these functions, or an API that relies on them such as URL.createObjectURL(), is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 randomInt() values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
This page as .md · .json · in your agent: get_signal("CVE-2026-106074")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.