Random UUID and Integer Generation Flaw in Node.js by OpenJS Foundation

CVE-2026-106074

What is CVE-2026-106074?

A security flaw exists in the Node.js crypto module that compromises the uniqueness of identifiers generated by certain functions. Specifically, internal entropy caches utilized by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() may persist in user-space startup snapshots when utilizing the --build-snapshot option. As a result, processes generated from these snapshots could potentially yield duplicate UUIDs and predictable random integers. This could lead to security risks where unique identifiers overlap and information from one process could be inferred from another due to observable output patterns.

References