CVE Feed

    Dashboard / CVE / CVE-2026-106074

    CVE-2026-106074

    A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

    Published:Oct 23, 2026
    Last Modified:Oct 23, 2026
    EPS:Oct 23, 2026
    EPSS Score:
    CVSS Score:4.8

    Affected Products

    Vendor
    Nodejs
    Product
    Nodejs

    Exploits

    https://github.com/CompleTech-Security/node-cve-2026-106074-checkhttps://github.com/completetech-security/node-cve-2026-106074-checkhttps://github.com/CompleTetech-Security/node-cve-2026-106074-check

    Related CVEs

    CVE-2026-106069 (CVSS 7.4) — A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different…
    CVE-2026-105481 (CVSS 6.5) — A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent b…
    CVE-2026-105482 (CVSS 7.4) — A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.re…
    CVE-2026-106071 (CVSS 3.6) — A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildca…
    CVE-2026-106072 (CVSS 6.7) — A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP end…
    CVE-2026-105483 (CVSS 7.4) — A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenti…
    CVE-2026-106070 (CVSS 3.7) — A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entr…
    CVE-2026-106073 (CVSS 3.3) — A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read…
    CVE-2026-111497 (CVSS 9.2) — A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through…
    CVE-2026-48932 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High