BIT-node-2026-106074

    Dashboard / Vulnerabilities / BIT-node-2026-106074

    BIT-node-2026-106074

    Published: 29 Oct 2026Last Modified: 29 Oct 2026

    Summary:

    Details: A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

    References: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases, https://nvd.nist.gov/vuln/detail/CVE-2026-106074

    Affected packages

    Package

    Name: node

    Purl: pkg:bitnami/node

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -22.23.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-node-2026-106074 | CVE-DB