{"id":"CVE-2026-106074","kind":"vulnerability","aliases":["CVE-2026-106074"],"related":[],"title":"Node.js: snapshot builds freeze random UUID and integer caches across processes","description":"A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.\n\nIf any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","summary":"Node.js saves its random UUID and randomInt entropy caches into startup snapshots and single executable applications built with snapshots. Every process started from such a snapshot returns the same values until the cache refills, so identifiers can collide and be predicted from another process.","severity":"medium","cvss":4.8,"epss":0.00253,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cli-tools","node.js","poc-public","runtime","self-hosted"],"not_affected_if":["default-config","no-snapshots"],"how_to_check":"- Run `node --version` and compare against the fixed releases listed in the advisory.\n- Search build scripts for `--build-snapshot` or `useSnapshot` and check whether `crypto.randomUUID()`, `crypto.randomUUIDv7()`, `crypto.randomInt()` or `URL.createObjectURL()` run during snapshot construction.","fix":"- Upgrade Node.js 26.x, 24.x or 22.x to the patched release named in the Node.js security advisory (exact version unknown from the sources).\n- Rebuild any snapshot or single executable application after upgrading, or avoid calling these random APIs while the snapshot is built.","status":"open","published_at":"2026-10-23T17:17:20+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:32:58+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:32:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 26.x, 24.x or 22.x to the patched release named in the Node.js security advisory (exact version unknown from the sources).\n- Rebuild any snapshot or single executable application after upgrading, or avoid calling these random APIs while the snapshot is built.","reach":"local","title":"Node.js: snapshot builds freeze random UUID and integer caches across processes","impact":"medium","summary":"Node.js saves its random UUID and randomInt entropy caches into startup snapshots and single executable applications built with snapshots. Every process started from such a snapshot returns the same values until the cache refills, so identifiers can collide and be predicted from another process.","category":"runtime","nicknames":[],"who_cares":["node.js","self-hosted","cli-tools"],"confidence":0.7,"needs_auth":"no","worst_case":"Identifiers collide across processes and random values become predictable to other processes","analyst_note":"Confirm the patched Node.js versions for 26.x, 24.x and 22.x from the official Node.js security advisory, since the sources give no fixed version.","how_to_check":"- Run `node --version` and compare against the fixed releases listed in the advisory.\n- Search build scripts for `--build-snapshot` or `useSnapshot` and check whether `crypto.randomUUID()`, `crypto.randomUUIDv7()`, `crypto.randomInt()` or `URL.createObjectURL()` run during snapshot construction.","needs_analyst":true,"not_affected_if":["no-snapshots","default-config"],"who_is_affected":"Only applications that use Node.js startup snapshots (`--build-snapshot`) or single executable applications built with `useSnapshot`, and that call the affected random APIs while the snapshot is being built. Ordinary Node.js processes that do not use snapshots are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":3551,"output_tokens":674,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106074':14A,17A '-2026':13A,16A '000':152C '1':151C '127':147C '22':185C '24':182C '26':180C 'across':10A,162C 'affect':178C 'anoth':71B,175C 'api':115C 'applic':44B,104C 'build':3A,99C 'build-snapshot':98C 'built':45B,105C,129C 'cach':9A,37B,61B,82C,142C 'call':124C 'caus':78C 'cli':19B 'cli-tool':18B 'collid':66B,161C 'crypto':77C 'crypto.randomint':88C 'crypto.randomuuid':85C 'crypto.randomuuidv7':86C 'cve':12A,15A 'entropi':36B,81C 'everi':48B,130C 'execut':43B,103C 'expect':156C 'flaw':74C 'freez':4A 'function':112C 'host':28B 'identifi':64B,155C 'integ':8A 'intern':80C 'issu':166C 'land':95C 'node.js':1A,21B,29B,76C,179C 'observ':174C 'one':168C 'poc':23B 'poc-publ':22B 'predict':69B,172C 'process':11A,49B,72B,131C,163C,169C 'public':24B 'random':5A,32B 'randomint':35B,153C 'refil':62B,144C 'reli':117C 'return':55B,136C 'runtim':25B 'save':30B,91C 'self':27B 'self-host':26B 'singl':42B,102C 'snapshot':2A,40B,47B,54B,97C,100C,127C,135C 'start':50B,132C 'startup':39B,96C 'tool':20B 'uniqu':159C 'url.createobjecturl':122C 'use':83C 'user':94C 'user-land':93C 'usesnapshot':107C 'uuid':6A,33B,148C 'valu':58B,139C,154C,165C 'vulner':177C 'x':181C,183C,186C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use Node.js startup snapshots (`--build-snapshot`) or single executable applications built with `useSnapshot`, and that call the affected random APIs while the snapshot is being built. Ordinary Node.js processes that do not use snapshots are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T17:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-106074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106074","severity":null,"published_at":"2026-10-23T17:17:20+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"github-poc","external_id":"CompleteTech-LLC/node-cve-2026-106074-check","url":"https://github.com/CompleteTech-LLC/node-cve-2026-106074-check","severity":null,"published_at":"2026-10-23T23:48:04+00:00","modified_at":null,"first_seen_at":"2026-10-23T23:55:02+00:00","fetched_at":"2026-10-23T23:55:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-106074","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106074","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":2242,"url":"https://github.com/CompleteTech-LLC/node-cve-2026-106074-check","title":"CompleteTech-LLC/node-cve-2026-106074-check","kind":"poc","source":"github","text":"Standalone defensive checker project for CVE-2026-106074: Node.js: Crypto entropy cache duplication in snapshots. One exploit per repository; implementation pending.\n\nstars 0","published_at":"2026-10-23T23:48:04+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}