VDB

CVE-2026-106074

CVE-2026-106074 PUBLISHED CVSS 4.8 MEDIUM

Reported by hackerone · Published October 23, 2026

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
nodejs-debugsourceerrata.rockylinux.org1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64
nodejs-docserrata.rockylinux.org1:24.22.1-3.module+el9.8.0+40401+e24b8c95.noarch, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.noarch
nodejs-develerrata.rockylinux.org1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64
v8-13.6-develerrata.rockylinux.org3:13.6.233.17-1.24.22.1.3.module+el9.8.0+40401+e24b8c95.x86_64, 3:13.6.233.17-1.24.22.1.3.module+el9.8.0+40401+e24b8c95.s390x, 3:13.6.233.17-1.24.22.1.3.module+el9.8.0+40401+e24b8c95.ppc64le, 3:13.6.233.17-1.24.22.1.3.module+el9.8.0+40401+e24b8c95.aarch64, 3:13.6.233.17-1.24.22.1.1.module+el8.10.0+40400+ee85ddea.x86_64, 3:13.6.233.17-1.24.22.1.1.module+el8.10.0+40400+ee85ddea.aarch64
nodejs-nodemonerrata.rockylinux.org0:3.1.14-3.module+el9.8.0+40281+14cc6568.src, 0:3.1.14-3.module+el9.8.0+40281+14cc6568.noarch, 0:3.1.14-2.module+el8.10.0+40278+50b003a3.src, 0:3.1.14-2.module+el8.10.0+40278+50b003a3.noarch, 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e.src, 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e.noarch
nodejs-packagingerrata.rockylinux.org0:2021.06-6.module+el9.8.0+40164+8921ab53.src, 0:2021.06-6.module+el9.8.0+40164+8921ab53.noarch, 0:2021.06-6.module+el9.7.0+40165+d075e3f2.src, 0:2021.06-6.module+el9.7.0+40165+d075e3f2.noarch, 0:2021.06-6.module+el9.7.0+40153+4d595597.src, 0:2021.06-6.module+el9.7.0+40153+4d595597.noarch, 0:2021.06-6.module+el9.7.0+40052+e32ea525.src, 0:2021.06-6.module+el9.7.0+40052+e32ea525.noarch, 0:2021.06-6.module+el8.10.0+40172+38f6fdd1.src, 0:2021.06-6.module+el8.10.0+40172+38f6fdd1.noarch, 0:2021.06-6.module+el8.10.0+40171+8fa9c325.src, 0:2021.06-6.module+el8.10.0+40171+8fa9c325.noarch, 0:2021.06-6.module+el8.10.0+40048+6d99f608.src, 0:2021.06-6.module+el8.10.0+40048+6d99f608.noarch
nodejs-libserrata.rockylinux.org1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64
nodejs22-develAmazon Linux1:22.23.4-1.amzn2023.0.1
nodejserrata.rockylinux.org1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.src, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.src, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64
nodejs24-docsAmazon Linux1:24.22.1-1.amzn2023.0.1
nodejs-full-i18nerrata.rockylinux.org1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64
nodejs-debuginfoerrata.rockylinux.org1:24.22.1-3.module+el9.8.0+40401+e24b8c95.x86_64, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.s390x, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.ppc64le, 1:24.22.1-3.module+el9.8.0+40401+e24b8c95.aarch64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.x86_64, 1:24.22.1-1.module+el8.10.0+40400+ee85ddea.aarch64

22 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.0
4.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

VendorProductVersions
nodejsnode22.23.3, 24.22.0, 26.12.0
amazon:2023nodejs22-devel0
amazon:2023nodejs24-docs0
amazon:2023nodejs22-libs0
amazon:2023nodejs220
nodejsnode24.22.0, 22.23.3, 26.12.0
amazon:2023nodejs22-npm0
amazon:2023v8-13.6-devel0
amazon:2023v8-12.4-devel0
amazon:2023nodejs240
amazon:2023nodejs22-docs0
alpinenodejs0, 0
chainguardnodejs-220
wolfinodejs-240
amazon:2023nodejs22-full-i18n0
wolfinodejs-260
amazon:2023nodejs24-npm0
amazon:2023nodejs24-devel0
alpinenodejs-current0
amazon:2023nodejs24-libs0

…and 2 more

Timeline

  • Oct 23, 2026 CVE Published
  • Oct 24, 2026 EPSS Score (4 in total, the first dated here)
  • Oct 27, 2026 Security Advisory (3 in total, the first dated here)
  • Oct 30, 2026 Distribution Patch (3 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-106074
vulnetix vdb fixes CVE-2026-106074

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-106074/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›