{"id":"CVE-2015-8851","aliases":["CLSA-2026-1772669613","DEBIAN-CVE-2015-8851","EUVD-2020-0358","GHSA-265q-28rp-chq5","RHBA-2016:1343","UBUNTU-CVE-2015-8851"],"status":"published","title":"Insecure Entropy Source - Math.random() in node-uuid","description":"node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02257,"percentile":0.83208,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-331"],"published":"2020-01-30T20:43:26Z","modified":"2026-10-15T09:45:25Z","fixes":[{"ecosystem":"npm","package":"node-uuid","fixed_in":["1.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"node-uuid","fixed_in":["1.4.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-uuid","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-uuid","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-uuid","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-clients","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-clients-redistributable","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-dockerregistry","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-master","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-node","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-pod","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-recycle","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-sdn-ovs","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-tests","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"heapster","fixed_in":["0:1.1.0-1.beta2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.2::el7","package":"tuned-profiles-atomic-openshift-node","fixed_in":["0:3.2.1.1-1.git.0.96f9555.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.3-tuxcare.0"},{"fixed":"1.4.3-tuxcare.1"}]}],"versions":["1.4.3"]},{"source":"osv","ecosystem":"Debian:12","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"npm","package":"node-uuid","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.4"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-dockerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-recycle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"heapster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-1.beta2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"tuned-profiles-atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.1.1-1.git.0.96f9555.el7"}]}]}],"products":[{"vendor":"node-uuid","product":"node-uuid"},{"vendor":"node-uuid_project","product":"node-uuid"}],"references":[{"url":"https://github.com/broofa/node-uuid/commit/672f3834ed02c798aa021c618d0a5666c8da000d","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"https://nodesecurity.io/advisories/93","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2016/04/13/8","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1327056","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8851","tags":["advisory"]},{"url":"https://github.com/broofa/node-uuid/issues/108","tags":["web"]},{"url":"https://github.com/broofa/node-uuid/issues/122","tags":["web"]},{"url":"https://www.npmjs.com/advisories/93","tags":["web"]},{"url":"https://github.com/advisories/GHSA-265q-28rp-chq5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8851","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2016:1343","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305131","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1322271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1324179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1326523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1327500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1331816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1334249","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1334485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1334501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1334866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1336526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1339174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1340324","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhba-2016_1343.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8851","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8851","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2015-8851","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8851","description":"node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.","status":"published","published":"2020-01-30T20:43:26Z","modified":"2026-10-07T20:07:29.354Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2020-0358","description":"node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.","status":"published","published":"2020-01-30T20:43:26Z","modified":"2026-10-07T20:07:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:33.904651Z"}],"ghsa":[{"id":"GHSA-265q-28rp-chq5","title":"Insecure Entropy Source - Math.random() in node-uuid","description":"Affected versions of `node-uuid` consistently fall back to using `Math.random` as an entropy source instead of `crypto`, which may result in guessable UUID's.\n\n\n\n## Recommendation\n\nUpdate to version 1.4.4 or later.","status":"published","published":"2020-04-16T03:14:50Z","modified":"2023-01-09T05:02:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:36:03.040255Z"}],"nvd":[{"id":"CVE-2015-8851","description":"node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.","status":"published","published":"2020-01-30T21:15:14.653Z","modified":"2026-10-07T21:16:59.953Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:03:19.73542Z"}],"osv":[{"id":"CVE-2015-8851","description":"node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.","status":"published","published":"2020-01-30T21:15:14Z","modified":"2026-04-10T03:46:35.163825Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8851","description":"node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.","status":"published","published":"2020-01-30T21:15:14.653Z","modified":"2026-10-08T00:47:35.079574107Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"GHSA-265q-28rp-chq5","title":"Insecure Entropy Source - Math.random() in node-uuid","description":"Affected versions of `node-uuid` consistently fall back to using `Math.random` as an entropy source instead of `crypto`, which may result in guessable UUID's.\n\n\n\n## Recommendation\n\nUpdate to version 1.4.4 or later.","status":"published","published":"2020-04-16T03:14:50Z","modified":"2023-11-08T03:58:03.317446Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"UBUNTU-CVE-2015-8851","description":"node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.","status":"withdrawn","published":"2020-01-30T21:15:00Z","modified":"2025-07-16T07:33:39.942788Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"CLSA-2026-1772669613","title":"TuxCare security update for node-uuid (1 CVE)","description":"TuxCare rebuilt node-uuid to address 1 CVE. Fixed in 1.4.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:45:25.564886814Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"RHBA-2016:1343","title":"Red Hat Bug Fix Advisory: Red Hat OpenShift Enterprise 3.2.1.1 bug fix and enhancement update","status":"published","published":"2024-09-15T23:31:13Z","modified":"2026-10-08T10:01:08Z","updated_at":"2026-11-02T15:52:58.117212Z"}]}}