CVE-2026-106074

Overview

Node.js is an asynchronous, event-driven JavaScript runtime designed for building scalable network applications. Its crypto module's crypto.randomUUID(), crypto.randomUUIDv7() and crypto.randomInt() functions draw random bytes from the operating system's secure generator through Node.js's native code, and keep a batch of those bytes in an in-memory cache so that most calls avoid a native round trip. Node.js can also save an application's initialized heap into a user-land startup snapshot (built with --build-snapshot, or embedded in a single executable application with useSnapshot) so that later processes start from that state.

A use of insufficiently random values vulnerability (CVE-2026-106074) has been identified in Node.js's crypto module. Each process is supposed to draw its own random values, so identifiers generated by different processes never repeat and cannot be predicted from one another. However, the entropy caches were ordinary heap data and were saved into the snapshot with everything else. If any of these functions, or an API that relies on them such as URL.createObjectURL(), was called while the snapshot was built, every process started from it returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 randomInt() values.

This behaviour maps to CWE-330 (Use of Insufficiently Random Values), where a product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. In Node.js, identifiers expected to be unique, such as session, request or job IDs, can collide across processes started from the same snapshot. Values issued by one process can also be predicted by observing another.

Exploitation requires an application that is distributed or deployed as a user-land startup snapshot or a single executable application with useSnapshot enabled, and that calls one of the affected functions while the snapshot is being built. An attacker who can observe values from one instance can then predict the first values issued by another. Applications that do not use user-land snapshots, or that never touch these functions during the snapshot build, are not affected. The Node.js project describes the issue as affecting its supported 22.x, 24.x and 26.x lines; crypto.randomUUIDv7() exists only on 24.x and 26.x. The same caches and --build-snapshot support are also present on the End-of-Life 18.x, 19.x, 20.x, 21.x, 23.x and 25.x lines. The 12.x and 14.x lines cannot build user-land snapshots, and the 16.x release binary does not accept --build-snapshot.

Details

Module Info

• Product: Node.js
• Affected packages: node (built-in crypto module; lib/internal/crypto/random.js, lib/internal/v8/startup_snapshot.js)
• Affected versions: >=18.8.0 <=21.7.3, >=22.0.0 <22.23.4, >=23.0.0 <=23.11.1, >=24.0.0 <24.22.1, >=25.0.0 <=25.9.0, >=26.0.0 <26.12.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable; Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package
• Fixed in: Node.js 22.23.4, 24.22.1, and 26.12.1; Node.js NES v18.20.20, v20.20.5, v20.20.13, and v22.23.5

Vulnerability Info

This Medium-severity vulnerability is found in the entropy caches of crypto.randomUUID(), crypto.randomUUIDv7() and crypto.randomInt() in Node.js's crypto module (lib/internal/crypto/random.js). The HackerOne CNA scores it 4.8 (CVSS v3.0), and the Node.js project also rates it Medium. NVD has not yet scored it.

The caches are module-level buffers, filled from the secure generator on first use and consumed a slice at a time.

When a user-land snapshot is built, Node.js serializes the whole JavaScript heap, including these buffers and their offsets. Nothing cleared them before serialization, so a snapshot built after a call to one of these functions carried the unused part of the cache. Each process deserialized from the snapshot then resumed from the same offset and returned the same UUIDs and integers as every other process started from that snapshot. This also applied to crypto.randomUUID() on globalThis and to blob URLs from URL.createObjectURL(), which use the same UUID cache. The fix registers a reset that zeroes and discards the caches after the user's serialize callbacks run, and again before the user's deserialize callbacks, because microtasks and exit handlers can refill them in between.

An attacker would need to obtain values generated by one instance of an application built from an affected snapshot, for example identifiers returned in responses, and use them to predict or collide with values from another instance.

Note: Values that the application itself generates and stores during the snapshot build are intentionally shared by every process and are not changed by the fix. Only values drawn after startup are affected.

Mitigation

Node.js 22.x, 24.x and 26.x are supported and are fixed in 22.23.4, 24.22.1 and 26.12.1 and later. Every other release line is past its support window and never received an upstream fix. Node.js 18.x reached End-of-Life on April 30, 2025; Node.js 19.x on June 1, 2023; Node.js 20.x on April 30, 2026; Node.js 21.x on June 1, 2024; Node.js 23.x on June 1, 2025; and Node.js 25.x on June 1, 2026. For more information see the Node.js previous releases schedule.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1 or later on those lines, all of which include this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• gesposito (reporter)
• panva (remediation developer)