CVE-2026-41907 Details
Description
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.
A vulnerability exists in the uuid library, specifically in versions prior to 14.0.0, within the UUID generation functions v3, v5, and v6. These functions accept external output buffers but lack proper validation to prevent out-of-range writes. This oversight enables silent partial writes into buffers provided by the caller, potentially leading to the creation of malformed or truncated UUIDs without any error indication. In contrast, functions v4, v1, and v7 correctly throw a RangeError for invalid buffer bounds.
Users should upgrade to uuid version 14.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
| CWE-823 | Use of Out-of-range Pointer Offset | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uuidjs uuid | < 11.1.1 12.0.0 13.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |