CVE-2026-41988: Low severity npm/uuid vulnerability
Published Apr 23, 2026
·Updated
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
Affected Software
6 affected componentsFixes available
npm/uuid<14.0.0
Uuidjs Uuid Node.js<11.1.1
Uuidjs Uuid Node.js=12.0.0
Uuidjs Uuid Node.js=13.0.0
IBM Db2 Genius Hub<=1.1, 1.1.1, 1.1.2
IBM Agentics<=1.0
Event History
Apr 23, 2026
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 13, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-41988?
CVE-2026-41988 has a moderate severity due to unexpected writes when using certain UUID versions.
2
How do I fix CVE-2026-41988?
To fix CVE-2026-41988, upgrade to uuid version 14.0.0 or later.
3
What UUID versions are affected by CVE-2026-41988?
CVE-2026-41988 affects UUID versions 3, 5, and 6 when external output buffers are used.
4
Is UUID version 4 vulnerable to CVE-2026-41988?
No, UUID version 4 is unaffected by CVE-2026-41988.
5
Which software package is primarily affected by CVE-2026-41988?
The npm package 'uuid' versions prior to 14.0.0 are primarily affected by CVE-2026-41988.