CVE-2026-41907: uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
uuidto a version that resolves this vulnerability.Fixed in 14.0.0Patch Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41907?
CVE-2026-41907 is considered a critical vulnerability due to the potential for silent partial writes that can lead to data corruption.
How do I fix CVE-2026-41907?
To fix CVE-2026-41907, upgrade the uuid library to version 14.0.0 or later, which includes proper buffer bounds checks.
What software is affected by CVE-2026-41907?
CVE-2026-41907 affects versions of the npm/uuid library prior to 14.0.0.
What is the risk of not addressing CVE-2026-41907?
Not addressing CVE-2026-41907 can lead to serious security issues such as data corruption and application instability.
What are the implications of CVE-2026-41907 for developers?
Developers using the affected versions of the uuid library should implement the recommended update as soon as possible to prevent vulnerabilities in their applications.