{"id":"CVE-2026-41988","aliases":["DEBIAN-CVE-2026-41988","EUVD-2026-25190","GHSA-qmq6-f8pr-cx5x","GHSA-w5hq-g745-h8pq","UBUNTU-CVE-2026-41988"],"status":"published","title":"Duplicate Advisory: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","description":"uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","severity":{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00181,"percentile":0.07784,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1285","CWE-670","CWE-787","CWE-823"],"published":"2026-04-22T20:53:24Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Debian:14","package":"node-uuid","fixed_in":["14.0.0+~11.0.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.0+~11.0.0-1","14.0.1-1","14.0.2-1","14.0.3-1","14.0.3-2","8.3.2+~8.3.3-3","8.3.2+~8.3.3-4","8.3.2+~8.3.4-1","8.3.2+~8.3.4-2","8.3.2+~8.3.4-3"]},{"source":"osv","ecosystem":"Debian:13","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.0+~11.0.0-1","14.0.1-1","14.0.2-1","14.0.3-1","14.0.3-2","8.3.2+~8.3.4-1","8.3.2+~8.3.4-2","8.3.2+~8.3.4-3"]},{"source":"osv","ecosystem":"Debian:14","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0+~11.0.0-1"}]}],"versions":["8.3.2+~8.3.4-1","8.3.2+~8.3.4-2","8.3.2+~8.3.4-3"]},{"source":"osv","ecosystem":"npm","package":"uuid","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"uuid","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"uuid","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"13.0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-2","1.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1","1.4.7-5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.0-4","8.3.2+~8.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.3-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.4-3","14.0.0+~11.0.0-1","14.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-uuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+~8.3.4-1","8.3.2+~8.3.4-3"]}],"products":[{"vendor":"uuidjs","product":"uuid"}],"references":[{"url":"https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","tags":["exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","tags":["Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41988","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qmq6-f8pr-cx5x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41907.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41988.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41988","tags":["advisory"]},{"url":"https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","tags":["web"]},{"url":"https://github.com/uuidjs/uuid","tags":["package"]},{"url":"https://github.com/uuidjs/uuid/releases/tag/v11.1.1","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/releases/tag/v12.0.1","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/releases/tag/v13.0.1","tags":["web"]},{"url":"https://github.com/uuidjs/uuid/releases/tag/v14.0.0","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-41988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41988","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41988","description":"uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","status":"published","published":"2026-04-23T04:00:54.96Z","modified":"2026-04-23T16:22:56.684Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-25190","description":"uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","status":"published","published":"2026-04-23T04:00:54Z","modified":"2026-04-23T16:22:56Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:24:19.171803Z"}],"ghsa":[{"id":"GHSA-qmq6-f8pr-cx5x","title":"Duplicate Advisory: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w5hq-g745-h8pq. This link is maintained to preserve external references.\n\n## Original Advisory\nuuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","status":"withdrawn","published":"2026-04-23T06:30:22Z","modified":"2026-05-05T12:59:19Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:40:00.970271Z"}],"nvd":[{"id":"CVE-2026-41988","description":"uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","status":"published","published":"2026-04-23T05:16:05.613Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"CVE-2026-41907","title":"uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided","description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","status":"published","published":"2026-04-24T18:09:24.744Z","modified":"2026-10-28T02:31:14.607312456Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-787","CWE-823"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"CVE-2026-41988","description":"uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","status":"published","published":"2026-04-23T04:00:54.96Z","modified":"2026-10-28T02:30:24.097222827Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-41988","description":"uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","status":"published","published":"2026-04-23T05:16:05.613Z","modified":"2026-10-27T10:01:22.592785656Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-qmq6-f8pr-cx5x","title":"Duplicate Advisory: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w5hq-g745-h8pq. This link is maintained to preserve external references.\n\n## Original Advisory\nuuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","status":"withdrawn","published":"2026-04-23T06:30:22Z","modified":"2026-05-05T16:10:14.946619Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"GHSA-w5hq-g745-h8pq","title":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","description":"### Summary\n\nThe `v3()`, `v5()`, and `v6()` [API methods](https://github.com/uuidjs/uuid#api-summary) (not `uuid` release versions) accept external output buffers but do not reject out-of-range writes (small `buf` or large `offset`).  \nBy contrast, `v4()`, `v1()`, and `v7()` API methods explicitly throw `RangeError` on invalid bounds.\n\nThis inconsistency allows **silent partial writes** into caller-provided buffers.\n\n\n### Affected code\n\n- `src/v35.ts` (`v3()`/`v5()` path) writes `buf[offset + i]` without bounds validation.\n- `src/v6.ts` writes `buf[offset + i]` without bounds validation.\n\n### Reproducible PoC\n\n```bash\ncd /home/StrawHat/uuid\nnpm ci\nnpm run build\n\nnode --input-type=module -e \"\nimport {v4,v5,v6} from './dist-node/index.js';\nconst ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';\nfor (const [name,fn] of [\n  ['v4()',()=\u003ev4({},new Uint8Array(8),4)],\n  ['v5()',()=\u003ev5('x',ns,new Uint8Array(8),4)],\n  ['v6()',()=\u003ev6({},new Uint8Array(8),4)],\n]) {\n  try { fn(); console.log(name,'NO_THROW'); }\n  catch(e){ console.log(name,'THREW',e.name); }\n}\"\n```\n\nObserved:\n\n- `v4() THREW RangeError`\n- `v5() NO_THROW`\n- `v6() NO_THROW`\n\nExample partial overwrite evidence captured during audit:\n\n```text\nsame true buf [\n  170, 170, 170, 170,\n   75, 224, 100,  63\n]\nv6 [\n  187, 187, 187, 187,\n   31,  19, 185,  64\n]\n```\n\n### Security impact\n\n- **Primary**: integrity/robustness issue (silent partial output).\n- If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.\n- In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.\n\n### Suggested fix\n\nAdd the same guard used by `v4()`/`v1()`/`v7()`:\n\n```ts\nif (offset \u003c 0 || offset + 16 \u003e buf.length) {\n  throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);\n}\n```\n\nApply to:\n\n- `src/v35.ts` (covers `v3()` and `v5()`)\n- `src/v6.ts`","status":"published","published":"2026-04-22T20:53:24Z","modified":"2026-09-10T03:51:03.66333665Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1285","CWE-787"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2026-41988","description":"uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.","status":"published","published":"2026-04-23T05:16:00Z","modified":"2026-10-17T13:00:04.241085175Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"},{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:18.393417Z"}]}}