CVE-2026-41988 Details
Description
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
A vulnerability in the uuid package, affecting versions through 13.0.0, allows for unexpected writes to external output buffers when certain UUID versions are used. This issue arises in UUID versions 3, 5, and 6, while version 4, which is commonly used, remains unaffected. The vulnerability stems from missing bounds checks, enabling silent partial writes into caller-provided buffers. Exploitation could lead to the corruption of UUIDs, causing applications to process malformed or truncated identifiers without any error indication.
Users can upgrade to uuid version 14.0.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq | CISA-ADP | ExploitVendor Advisory |
| https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34 | [email protected] | Patch |
| https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-670 | Always-Incorrect Control Flow Implementation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uuidjs uuid | < 11.1.1 12.0.0 13.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | New CVE Received | [email protected] |