{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106074", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-10-06T15:00:00.655Z", "datePublished": "2026-10-23T16:15:05.829Z", "dateUpdated": "2026-10-23T16:15:05.829Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.\n\nIf any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."}], "affected": [{"defaultStatus": "unaffected", "vendor": "nodejs", "product": "node", "versions": [{"version": "22.23.3", "status": "affected", "lessThanOrEqual": "22.23.3", "versionType": "semver"}, {"version": "24.22.0", "status": "affected", "lessThanOrEqual": "24.22.0", "versionType": "semver"}, {"version": "26.12.0", "status": "affected", "lessThanOrEqual": "26.12.0", "versionType": "semver"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-330", "description": "CWE-330 Use of Insufficiently Random Values"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-10-23T16:15:05.829Z"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThanOrEqual": "22.23.3", "status": "affected", "version": "22.23.3", "versionType": "semver"}, {"lessThanOrEqual": "24.22.0", "status": "affected", "version": "24.22.0", "versionType": "semver"}, {"lessThanOrEqual": "26.12.0", "status": "affected", "version": "26.12.0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.\n\nIf any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."}], "id": "CVE-2026-106074", "lastModified": "2026-10-23T19:42:24.553", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "support@hackerone.com", "type": "Secondary"}]}, "published": "2026-10-23T17:17:20.473", "references": [{"source": "support@hackerone.com", "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-330"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "id": "2560016", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560016"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-335", "details": ["A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. If those APIs (or dependents such as URL.createObjectURL()) run while the snapshot is built, every process started from that snapshot can replay the same initial values until the cache is refilled (on the order of 127 UUIDs and about 1,000 randomInt values). Identifiers expected to be unique may collide across processes, and values from one process may be predictable to an observer of another process started from the same snapshot."], "mitigation": {"lang": "en:us", "value": "Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation.\nRebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase.\nPrefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization."}, "name": "CVE-2026-106074", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nodejs22", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nodejs24", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nodejs26", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:26/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/nodejs", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nodejs22", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nodejs24", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nodejs26", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-23T16:15:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106074\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106074\nhttps://nodejs.org/en/blog/vulnerability/october-2026-security-releases"], "statement": "This is a Moderate severity flaw. Red Hat rates it Moderate because impact is limited to confidentiality and integrity of early pseudo-random values (Low/Low) and exploitation requires building or distributing a startup snapshot or SEA with useSnapshot after exercising the affected APIs (high attack complexity; non-default deployment pattern). Typical Red Hat Node.js RPM and service deployments that do not ship custom snapshots are less exposed in practice, but the vulnerable code is present in affected Node.js streams. OS-level hardening does not reset Node/V8 entropy caches across snapshot restore.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.23.3,22.23.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[24.22.0,24.22.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.12.0,26.12.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "created": "2026-10-23T17:45:17.766615+00:00", "updated": "2026-10-26T14:30:13.658092+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}