{"id":"CVE-2026-41907","aliases":["AIKIDO-2026-10892","CLSA-2026-1777509596","CLSA-2026-1778805966","CLSA-2026-1778805967","CLSA-2026-1779065185","CLSA-2026-1782089806","CLSA-2026-1782089807","CLSA-2026-1782089809","CLSA-2026-1790718582","CLSA-2026-1790718709","CLSA-2026-1790718939","CLSA-2026-1790719328","CLSA-2026-1790767270","CLSA-2026-1792476235","CLSA-2026-1792477444","CLSA-2026-1793113739","DEBIAN-CVE-2026-41907","EUVD-2026-25600","GHSA-w5hq-g745-h8pq","ROOT-APP-NPM-CVE-2026-41907","ROOT-APP-NPM-GHSA-w5hq-g745-h8pq","UBUNTU-CVE-2026-41907"],"status":"published","title":"uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided","description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","severity":{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0035,"percentile":0.28892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1285","CWE-670","CWE-787","CWE-823"],"published":"2026-04-22T20:53:24Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"npm","package":"uuid","fixed_in":["12.0.1","13.0.1","11.1.1"],"sources":["ghsa"]},{"ecosystem":"TuxCare:npm","package":"uuid","fixed_in":["3.4.0-tuxcare.1","11.0.5-tuxcare.1","9.0.1-tuxcare.1","8.3.2-tuxcare.1","9.0.1-tuxcare.2","8.3.2-tuxcare.2","3.4.0-tuxcare.2","2.0.3-tuxcare.1","9.0.0-tuxcare.1","11.0.3-tuxcare.1","7.0.3-tuxcare.1","10.0.0-tuxcare.1","8.0.0-tuxcare.1","3.3.2-tuxcare.1","11.1.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-uuid","fixed_in":["14.0.0+~11.0.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"uuid","fixed_in":["10.0.0-aikido.3","11.1.0-aikido.3","8.3.2-aikido.3","11.0.3-aikido.3","8.0.0-aikido.2","8.3.2-aikido.4","8.3.2-aikido.5","11.1.0-aikido.4","8.0.0-aikido.3","10.0.0-aikido.4","9.0.1-aikido.3","9.0.1-aikido.4","3.4.0-aikido.1","9.0.0-aikido.1","7.0.3-aikido.1","13.0.0-aikido.3","11.1.1-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/uuid","fixed_in":["11.1.0-root.io.1","11.1.0-root.io.2","8.3.2-root.io.2","10.0.0-root.io.2","9.0.1-root.io.2","8.0.0-root.io.1","11.0.3-root.io.2","10.0.0-root.io.3","11.1.0-root.io.3","8.3.2-root.io.3","11.0.3-root.io.3","8.0.0-root.io.2","8.3.2-root.io.4","8.3.2-root.io.5","11.1.0-root.io.4","8.0.0-root.io.3","10.0.0-root.io.4","9.0.1-root.io.3","9.0.1-root.io.4","3.4.0-root.io.1","9.0.0-root.io.1","7.0.3-root.io.1","13.0.0-root.io.1","13.0.0-root.io.3","11.1.1-root.io.2","10.0.0-root.io.1","11.0.3-root.io.1","9.0.1-root.io.1","8.3.2-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0-tuxcare.0"},{"fixed":"3.4.0-tuxcare.1"}]}],"versions":["3.4.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.5-tuxcare.0"},{"fixed":"11.0.5-tuxcare.1"}]}],"versions":["11.0.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1-tuxcare.0"},{"fixed":"9.0.1-tuxcare.1"}]}],"versions":["9.0.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.2-tuxcare.0"},{"fixed":"8.3.2-tuxcare.1"}]}],"versions":["8.3.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1-tuxcare.0"},{"fixed":"9.0.1-tuxcare.2"}]}],"versions":["9.0.1","9.0.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.2-tuxcare.0"},{"fixed":"8.3.2-tuxcare.2"}]}],"versions":["8.3.2","8.3.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0-tuxcare.0"},{"fixed":"3.4.0-tuxcare.2"}]}],"versions":["3.4.0","3.4.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.3-tuxcare.0"},{"fixed":"2.0.3-tuxcare.1"}]}],"versions":["2.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-tuxcare.0"},{"fixed":"9.0.0-tuxcare.1"}]}],"versions":["9.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.3-tuxcare.0"},{"fixed":"11.0.3-tuxcare.1"}]}],"versions":["11.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.3-tuxcare.0"},{"fixed":"7.0.3-tuxcare.1"}]}],"versions":["7.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-tuxcare.0"},{"fixed":"10.0.0-tuxcare.1"}]}],"versions":["10.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-tuxcare.0"},{"fixed":"8.0.0-tuxcare.1"}]}],"versions":["8.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.2-tuxcare.0"},{"fixed":"3.3.2-tuxcare.1"}]}],"versions":["3.3.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.0-tuxcare.0"},{"fixed":"11.1.0-tuxcare.1"}]}],"versions":["11.1.0"]},{"source":"osv","ecosystem":"Debian:12","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.0+~11.0.0-1","14.0.1-1","14.0.2-1","14.0.3-1","14.0.3-2","8.3.2+~8.3.3-3","8.3.2+~8.3.3-4","8.3.2+~8.3.4-1","8.3.2+~8.3.4-2","8.3.2+~8.3.4-3"]},{"source":"osv","ecosystem":"Debian:13","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.0+~11.0.0-1","14.0.1-1","14.0.2-1","14.0.3-1","14.0.3-2","8.3.2+~8.3.4-1","8.3.2+~8.3.4-2","8.3.2+~8.3.4-3"]},{"source":"osv","ecosystem":"Debian:14","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0+~11.0.0-1"}]}],"versions":["8.3.2+~8.3.4-1","8.3.2+~8.3.4-2","8.3.2+~8.3.4-3"]},{"source":"osv","ecosystem":"npm","package":"uuid","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"uuid","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"uuid","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"13.0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-aikido.3"},{"fixed":"11.1.0-aikido.3"},{"fixed":"8.3.2-aikido.3"},{"fixed":"11.0.3-aikido.3"},{"fixed":"8.0.0-aikido.2"},{"fixed":"8.3.2-aikido.4"},{"fixed":"8.3.2-aikido.5"},{"fixed":"11.1.0-aikido.4"},{"fixed":"8.0.0-aikido.3"},{"fixed":"10.0.0-aikido.4"},{"fixed":"9.0.1-aikido.3"},{"fixed":"9.0.1-aikido.4"},{"fixed":"3.4.0-aikido.1"},{"fixed":"9.0.0-aikido.1"},{"fixed":"7.0.3-aikido.1"},{"fixed":"13.0.0-aikido.3"},{"fixed":"11.1.1-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.0-root.io.1"},{"fixed":"11.1.0-root.io.2"},{"fixed":"8.3.2-root.io.2"},{"fixed":"10.0.0-root.io.2"},{"fixed":"9.0.1-root.io.2"},{"fixed":"8.0.0-root.io.1"},{"fixed":"11.0.3-root.io.2"},{"fixed":"10.0.0-root.io.3"},{"fixed":"11.1.0-root.io.3"},{"fixed":"8.3.2-root.io.3"},{"fixed":"11.0.3-root.io.3"},{"fixed":"8.0.0-root.io.2"},{"fixed":"8.3.2-root.io.4"},{"fixed":"8.3.2-root.io.5"},{"fixed":"11.1.0-root.io.4"},{"fixed":"8.0.0-root.io.3"},{"fixed":"10.0.0-root.io.4"},{"fixed":"9.0.1-root.io.3"},{"fixed":"9.0.1-root.io.4"},{"fixed":"3.4.0-root.io.1"},{"fixed":"9.0.0-root.io.1"},{"fixed":"7.0.3-root.io.1"},{"fixed":"13.0.0-root.io.1"},{"fixed":"13.0.0-root.io.3"},{"fixed":"11.1.1-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-aikido.3"},{"fixed":"11.1.0-aikido.3"},{"fixed":"8.3.2-aikido.3"},{"fixed":"11.0.3-aikido.3"},{"fixed":"8.0.0-aikido.2"},{"fixed":"8.3.2-aikido.4"},{"fixed":"8.3.2-aikido.5"},{"fixed":"11.1.0-aikido.4"},{"fixed":"8.0.0-aikido.3"},{"fixed":"10.0.0-aikido.4"},{"fixed":"9.0.1-aikido.3"},{"fixed":"9.0.1-aikido.4"},{"fixed":"11.1.1-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-root.io.1"},{"fixed":"11.0.3-root.io.1"},{"fixed":"9.0.1-root.io.1"},{"fixed":"11.1.0-root.io.2"},{"fixed":"8.3.2-root.io.1"},{"fixed":"8.3.2-root.io.2"},{"fixed":"10.0.0-root.io.2"},{"fixed":"9.0.1-root.io.2"},{"fixed":"8.0.0-root.io.1"},{"fixed":"11.0.3-root.io.2"},{"fixed":"10.0.0-root.io.3"},{"fixed":"11.1.0-root.io.3"},{"fixed":"8.3.2-root.io.3"},{"fixed":"11.0.3-root.io.3"},{"fixed":"8.0.0-root.io.2"},{"fixed":"8.3.2-root.io.4"},{"fixed":"8.3.2-root.io.5"},{"fixed":"11.1.0-root.io.4"},{"fixed":"8.0.0-root.io.3"},{"fixed":"10.0.0-root.io.4"},{"fixed":"9.0.1-root.io.3"},{"fixed":"9.0.1-root.io.4"},{"fixed":"11.1.1-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-2","1.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1","1.4.7-5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.0-4","8.3.2+~8.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.3-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.4-3","14.0.0+~11.0.0-1","14.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.4-1","8.3.2+~8.3.4-3"]}],"products":[{"vendor":"uuidjs","product":"uuid"}],"references":[{"url":"https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","tags":["fix","web"]},{"url":"https://github.com/uuidjs/uuid/releases/tag/v14.0.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","tags":["advisory"]},{"url":"https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/releases/tag/v11.1.1","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/releases/tag/v12.0.1","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/releases/tag/v13.0.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w5hq-g745-h8pq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41907.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41988.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41988","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41907","tags":["advisory"]},{"url":"https://github.com/uuidjs/uuid","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-41907","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41907","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41907","title":"uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided","description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","status":"published","published":"2026-04-24T18:09:24.744Z","modified":"2026-04-27T13:35:34.363Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high","assessor":"cna"}],"cwes":["CWE-823","CWE-787"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-25600","description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","status":"published","published":"2026-04-24T18:09:24Z","modified":"2026-04-27T13:35:34Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"updated_at":"2026-11-02T19:24:17.84353Z"}],"ghsa":[{"id":"GHSA-w5hq-g745-h8pq","title":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","description":"### Summary\n\nThe `v3()`, `v5()`, and `v6()` [API methods](https://github.com/uuidjs/uuid#api-summary) (not `uuid` release versions) accept external output buffers but do not reject out-of-range writes (small `buf` or large `offset`).  \nBy contrast, `v4()`, `v1()`, and `v7()` API methods explicitly throw `RangeError` on invalid bounds.\n\nThis inconsistency allows **silent partial writes** into caller-provided buffers.\n\n\n### Affected code\n\n- `src/v35.ts` (`v3()`/`v5()` path) writes `buf[offset + i]` without bounds validation.\n- `src/v6.ts` writes `buf[offset + i]` without bounds validation.\n\n### Reproducible PoC\n\n```bash\ncd /home/StrawHat/uuid\nnpm ci\nnpm run build\n\nnode --input-type=module -e \"\nimport {v4,v5,v6} from './dist-node/index.js';\nconst ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';\nfor (const [name,fn] of [\n  ['v4()',()=\u003ev4({},new Uint8Array(8),4)],\n  ['v5()',()=\u003ev5('x',ns,new Uint8Array(8),4)],\n  ['v6()',()=\u003ev6({},new Uint8Array(8),4)],\n]) {\n  try { fn(); console.log(name,'NO_THROW'); }\n  catch(e){ console.log(name,'THREW',e.name); }\n}\"\n```\n\nObserved:\n\n- `v4() THREW RangeError`\n- `v5() NO_THROW`\n- `v6() NO_THROW`\n\nExample partial overwrite evidence captured during audit:\n\n```text\nsame true buf [\n  170, 170, 170, 170,\n   75, 224, 100,  63\n]\nv6 [\n  187, 187, 187, 187,\n   31,  19, 185,  64\n]\n```\n\n### Security impact\n\n- **Primary**: integrity/robustness issue (silent partial output).\n- If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.\n- In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.\n\n### Suggested fix\n\nAdd the same guard used by `v4()`/`v1()`/`v7()`:\n\n```ts\nif (offset \u003c 0 || offset + 16 \u003e buf.length) {\n  throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);\n}\n```\n\nApply to:\n\n- `src/v35.ts` (covers `v3()` and `v5()`)\n- `src/v6.ts`","status":"published","published":"2026-04-22T20:53:24Z","modified":"2026-05-21T18:25:57Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-787","CWE-1285"],"updated_at":"2026-11-02T14:40:13.628377Z"}],"nvd":[{"id":"CVE-2026-41907","description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","status":"published","published":"2026-04-24T19:17:14.49Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-787","CWE-823"],"updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"CVE-2026-41907","title":"uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided","description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","status":"published","published":"2026-04-24T18:09:24.744Z","modified":"2026-10-28T02:31:14.607312456Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-787","CWE-823"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"CVE-2026-41988","description":"uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","status":"published","published":"2026-04-23T04:00:54.96Z","modified":"2026-10-28T02:30:24.097222827Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-41907","description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","status":"published","published":"2026-04-24T19:17:14.49Z","modified":"2026-10-27T10:01:22.583062486Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-w5hq-g745-h8pq","title":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","description":"### Summary\n\nThe `v3()`, `v5()`, and `v6()` [API methods](https://github.com/uuidjs/uuid#api-summary) (not `uuid` release versions) accept external output buffers but do not reject out-of-range writes (small `buf` or large `offset`).  \nBy contrast, `v4()`, `v1()`, and `v7()` API methods explicitly throw `RangeError` on invalid bounds.\n\nThis inconsistency allows **silent partial writes** into caller-provided buffers.\n\n\n### Affected code\n\n- `src/v35.ts` (`v3()`/`v5()` path) writes `buf[offset + i]` without bounds validation.\n- `src/v6.ts` writes `buf[offset + i]` without bounds validation.\n\n### Reproducible PoC\n\n```bash\ncd /home/StrawHat/uuid\nnpm ci\nnpm run build\n\nnode --input-type=module -e \"\nimport {v4,v5,v6} from './dist-node/index.js';\nconst ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';\nfor (const [name,fn] of [\n  ['v4()',()=\u003ev4({},new Uint8Array(8),4)],\n  ['v5()',()=\u003ev5('x',ns,new Uint8Array(8),4)],\n  ['v6()',()=\u003ev6({},new Uint8Array(8),4)],\n]) {\n  try { fn(); console.log(name,'NO_THROW'); }\n  catch(e){ console.log(name,'THREW',e.name); }\n}\"\n```\n\nObserved:\n\n- `v4() THREW RangeError`\n- `v5() NO_THROW`\n- `v6() NO_THROW`\n\nExample partial overwrite evidence captured during audit:\n\n```text\nsame true buf [\n  170, 170, 170, 170,\n   75, 224, 100,  63\n]\nv6 [\n  187, 187, 187, 187,\n   31,  19, 185,  64\n]\n```\n\n### Security impact\n\n- **Primary**: integrity/robustness issue (silent partial output).\n- If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.\n- In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.\n\n### Suggested fix\n\nAdd the same guard used by `v4()`/`v1()`/`v7()`:\n\n```ts\nif (offset \u003c 0 || offset + 16 \u003e buf.length) {\n  throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);\n}\n```\n\nApply to:\n\n- `src/v35.ts` (covers `v3()` and `v5()`)\n- `src/v6.ts`","status":"published","published":"2026-04-22T20:53:24Z","modified":"2026-09-10T03:51:03.66333665Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1285","CWE-787"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"ROOT-APP-NPM-CVE-2026-41907","title":"CVE-2026-41907 in uuid - Patched by Root","description":"Root has patched CVE-2026-41907 in the uuid package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-05-18T09:13:58Z","modified":"2026-08-09T10:15:15.307593257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-41907","description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","status":"published","published":"2026-04-24T19:17:00Z","modified":"2026-10-17T13:00:04.490115962Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"CLSA-2026-1777509596","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 3.4.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:47.664845675Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778805966","title":"TuxCare security update for uuid (2 CVEs)","description":"TuxCare rebuilt uuid to address 2 CVEs. Fixed in 11.0.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:29.716970083Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778805967","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 9.0.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:30.219508001Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065185","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 8.3.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:27.689794021Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1782089806","title":"TuxCare security update for uuid (2 CVEs)","description":"TuxCare rebuilt uuid to address 2 CVEs. Fixed in 9.0.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:47:09.404017279Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782089807","title":"TuxCare security update for uuid (2 CVEs)","description":"TuxCare rebuilt uuid to address 2 CVEs. Fixed in 8.3.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:47:09.630296336Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782089809","title":"TuxCare security update for uuid (2 CVEs)","description":"TuxCare rebuilt uuid to address 2 CVEs. Fixed in 3.4.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:56.288188401Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1790718582","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 2.0.3-tuxcare.1.","status":"published","published":"2026-09-29T21:49:42Z","modified":"2026-10-15T09:47:53.671813986Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790718709","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 9.0.0-tuxcare.1.","status":"published","published":"2026-09-29T21:51:49Z","modified":"2026-10-15T09:47:57.349968318Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790718939","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 11.0.3-tuxcare.1.","status":"published","published":"2026-09-29T21:55:39Z","modified":"2026-10-15T09:47:53.545820829Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790719328","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 7.0.3-tuxcare.1.","status":"published","published":"2026-09-29T22:02:08Z","modified":"2026-10-15T09:47:57.432200247Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790767270","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 10.0.0-tuxcare.1.","status":"published","published":"2026-09-30T11:21:10Z","modified":"2026-10-15T09:47:53.547260437Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792476235","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 8.0.0-tuxcare.1.","status":"published","published":"2026-10-20T06:03:55Z","modified":"2026-10-20T07:15:15.626561332Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792477444","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 3.3.2-tuxcare.1.","status":"published","published":"2026-10-20T06:24:04Z","modified":"2026-10-20T07:15:16.131663171Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793113739","title":"TuxCare security update for uuid (1 CVE)","description":"TuxCare rebuilt uuid to address 1 CVE. Fixed in 11.1.0-tuxcare.1.","status":"published","published":"2026-10-27T15:08:59Z","modified":"2026-10-27T19:30:07.248287852Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"ROOT-APP-NPM-GHSA-w5hq-g745-h8pq","title":"GHSA-w5hq-g745-h8pq in uuid - Patched by Root","description":"Root has patched GHSA-w5hq-g745-h8pq in the uuid package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T15:12:28Z","modified":"2026-08-09T10:15:05.384407923Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}