p PatchFirst

CVE-2026-41907

CVE-2026-41907 · uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

This page contains facts from public vulnerability sources. Check the original advisory before updating.

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

CVSS 8.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • uuid

    Versions
    • < 14.0.0: Affected

    No fix published

  • node-uuid Debian:12

    Versions
    • 14.0.0+~11.0.0-1
    • 14.0.1-1
    • 14.0.2-1
    • 14.0.3-1
    • 14.0.3-2
    • 8.3.2+~8.3.3-3
    • 8.3.2+~8.3.3-4
    • 8.3.2+~8.3.4-1
    • 8.3.2+~8.3.4-2
    • 8.3.2+~8.3.4-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Debian:13

    Versions
    • 14.0.0+~11.0.0-1
    • 14.0.1-1
    • 14.0.2-1
    • 14.0.3-1
    • 14.0.3-2
    • 8.3.2+~8.3.4-1
    • 8.3.2+~8.3.4-2
    • 8.3.2+~8.3.4-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Debian:14

    Versions
    • 8.3.2+~8.3.4-1
    • 8.3.2+~8.3.4-2
    • 8.3.2+~8.3.4-3
    Affected ranges
    • ECOSYSTEM: < 14.0.0+~11.0.0-1

    Update to 14.0.0+~11.0.0-1

  • uuid npm

    Affected ranges
    • SEMVER: < 11.1.1

    Update to 11.1.1

  • uuid npm

    Affected ranges
    • SEMVER: ≥ 12.0.0, < 12.0.1

    Update to 12.0.1

  • uuid npm

    Affected ranges
    • SEMVER: ≥ 13.0.0, < 13.0.1

    Update to 13.0.1

  • node-uuid Ubuntu:14.04:LTS

    Versions
    • 1.3.3-2
    • 1.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Ubuntu:16.04:LTS

    Versions
    • 1.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Ubuntu:18.04:LTS

    Versions
    • 1.4.0-1
    • 1.4.7-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Ubuntu:20.04:LTS

    Versions
    • 3.3.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Ubuntu:22.04:LTS

    Versions
    • 8.3.2+~8.3.0-4
    • 8.3.2+~8.3.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Ubuntu:24.04:LTS

    Versions
    • 8.3.2+~8.3.3-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Ubuntu:25.10

    Versions
    • 8.3.2+~8.3.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Ubuntu:26.10

    Versions
    • 8.3.2+~8.3.4-3
    • 14.0.0+~11.0.0-1
    • 14.0.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-uuid Ubuntu:26.04:LTS

    Versions
    • 8.3.2+~8.3.4-1
    • 8.3.2+~8.3.4-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →