CVE-2026-106074
published 2026-10-23CVE-2026-106074: A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into…
PriorityP426medium4.8CVSS 3.0
AVNACHPRNUINSUCLILAN
EPSS
0.32%
24.7th percentile
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 22.23.3 – 22.23.3 | — |
| nodejs | node | 24.22.0 – 24.22.0 | — |
| nodejs | node | 26.12.0 – 26.12.0 | — |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.04.8MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nodejs: nodejs: predictable random values via snapshot entropy cache reuse
vendor_redhat·2026-10-23·CVSS 4.8
CVE-2026-106074 [MEDIUM] CWE-335 nodejs: nodejs: predictable random values via snapshot entropy cache reuse
nodejs: nodejs: predictable random values via snapshot entropy cache reuse
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.
This vulnerability affects Node.js **26.x
Fortinet
Multiple Node.js CVEs
vendor_fortinet·CVSS 6.5
CVE-2026-105482 [MEDIUM] Multiple Node.js CVEs
FG-IR-26-187: Multiple Node.js CVEs
CVSSv3 Score:
9.8
CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 -
GHSA
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-sn
ghsa_unreviewed·2026-10-23
CVE-2026-106074 [MEDIUM] CWE-330 A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-sn
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
VulDB
Node.js up to 22.23.2/24.21.0/26.11.0 Crypto random values
vuldb·2026-10-23·CVSS 4.8
CVE-2026-106074 [MEDIUM] Node.js up to 22.23.2/24.21.0/26.11.0 Crypto random values
A vulnerability identified as problematic has been detected in Node.js up to 22.23.2/24.21.0/26.11.0. This issue affects the function crypto.randomUUID/crypto.randomUUIDv7/crypto.randomInt of the component Crypto. This manipulation causes insufficiently random values.
This vulnerability is handled as CVE-2026-106074. The attack can be initiated remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106074 nodejs22: nodejs: predictable random values via snapshot entropy cache reuse [fedora-43]
bugzilla·2026-10-26·CVSS 4.8
CVE-2026-106074 [MEDIUM] CVE-2026-106074 nodejs22: nodejs: predictable random values via snapshot entropy cache reuse [fedora-43]
CVE-2026-106074 nodejs22: nodejs: predictable random values via snapshot entropy cache reuse [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values unti
Bugzilla
CVE-2026-106074 nodejs24: nodejs: predictable random values via snapshot entropy cache reuse [fedora-44]
bugzilla·2026-10-26·CVSS 4.8
CVE-2026-106074 [MEDIUM] CVE-2026-106074 nodejs24: nodejs: predictable random values via snapshot entropy cache reuse [fedora-44]
CVE-2026-106074 nodejs24: nodejs: predictable random values via snapshot entropy cache reuse [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values unti
Bugzilla
CVE-2026-106074 nodejs26: nodejs: predictable random values via snapshot entropy cache reuse [fedora-rawhide]
bugzilla·2026-10-26·CVSS 4.8
CVE-2026-106074 [MEDIUM] CVE-2026-106074 nodejs26: nodejs: predictable random values via snapshot entropy cache reuse [fedora-rawhide]
CVE-2026-106074 nodejs26: nodejs: predictable random values via snapshot entropy cache reuse [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values
Bugzilla
CVE-2026-106074 nodejs22: nodejs: predictable random values via snapshot entropy cache reuse [fedora-rawhide]
bugzilla·2026-10-26·CVSS 4.8
CVE-2026-106074 [MEDIUM] CVE-2026-106074 nodejs22: nodejs: predictable random values via snapshot entropy cache reuse [fedora-rawhide]
CVE-2026-106074 nodejs22: nodejs: predictable random values via snapshot entropy cache reuse [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values
Bugzilla
CVE-2026-106074 nodejs24: nodejs: predictable random values via snapshot entropy cache reuse [fedora-43]
bugzilla·2026-10-26·CVSS 4.8
CVE-2026-106074 [MEDIUM] CVE-2026-106074 nodejs24: nodejs: predictable random values via snapshot entropy cache reuse [fedora-43]
CVE-2026-106074 nodejs24: nodejs: predictable random values via snapshot entropy cache reuse [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values unti
Bugzilla
CVE-2026-106074 nodejs22: nodejs: predictable random values via snapshot entropy cache reuse [fedora-44]
bugzilla·2026-10-26·CVSS 4.8
CVE-2026-106074 [MEDIUM] CVE-2026-106074 nodejs22: nodejs: predictable random values via snapshot entropy cache reuse [fedora-44]
CVE-2026-106074 nodejs22: nodejs: predictable random values via snapshot entropy cache reuse [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values unti
Bugzilla
CVE-2026-106074 nodejs24: nodejs: predictable random values via snapshot entropy cache reuse [fedora-rawhide]
bugzilla·2026-10-26·CVSS 4.8
CVE-2026-106074 [MEDIUM] CVE-2026-106074 nodejs24: nodejs: predictable random values via snapshot entropy cache reuse [fedora-rawhide]
CVE-2026-106074 nodejs24: nodejs: predictable random values via snapshot entropy cache reuse [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values
Bugzilla
CVE-2026-106074 nodejs: nodejs: predictable random values via snapshot entropy cache reuse
bugzilla·2026-10-23·CVSS 4.8
CVE-2026-106074 [MEDIUM] CVE-2026-106074 nodejs: nodejs: predictable random values via snapshot entropy cache reuse
CVE-2026-106074 nodejs: nodejs: predictable random values via snapshot entropy cache reuse
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.
This vulnerability affe
Hackernews
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
blogs_hackernews·2026-10-22
CVE-2026-106069 Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix
2026-10-23
Published