CVE catalog

CVE-2026-106074

nodejs: CVE-2026-106074

[CVE catalog]

Severity
Medium · CVSS 4.8CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannodejssid24.22.1+dfsg+~cs24.19.2-1fixed
Debiannodejsforky24.21.0+dfsg+~cs24.13.4-1vulnerable
Debiannodejstrixie20.19.2+dfsg-1+deb13u2vulnerable
Debiannodejstrixie-security20.19.2+dfsg-1+deb13u3vulnerable
Debiannodejsbookworm18.20.4+dfsg-1~deb12u2vulnerable
Debiannodejsbookworm-security18.20.4+dfsg-1~deb12u3vulnerable
Ubuntunodejspro12.22.5~dfsg-5ubuntu1vulnerable
Ubuntunodejspro12.22.7~dfsg-2ubuntu1vulnerable
Ubuntunodejspro12.22.7~dfsg-2ubuntu3vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu2vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.1vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.2vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.3vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.4vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.5vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.6vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.6+esm2vulnerable
Ubuntunodejs24.0418.13.0+dfsg1-1ubuntu2vulnerable
Ubuntunodejs24.0418.19.1+dfsg-2ubuntu4vulnerable
Ubuntunodejs24.0418.19.1+dfsg-6ubuntu1vulnerable
Ubuntunodejs24.0418.19.1+dfsg-6ubuntu2vulnerable
Ubuntunodejs24.0418.19.1+dfsg-6ubuntu5vulnerable
Ubuntunodejs26.1022.22.1+dfsg+~cs22.19.15-1ubuntu1vulnerable
Ubuntunodejs26.1024.16.0+dfsg+~cs24.13.1-2ubuntu1vulnerable
Ubuntunodejs26.1024.18.0+dfsg+~cs24.13.2-1ubuntu1vulnerable
Ubuntunodejs26.1024.19.0+dfsg+~cs24.13.3-1ubuntu1vulnerable
Ubuntunodejs26.0420.19.4+dfsg-1vulnerable
Ubuntunodejs26.0420.19.5+dfsg+~cs20.19.12-4vulnerable
Ubuntunodejs26.0422.21.1+dfsg+~cs22.19.0-6ubuntu4vulnerable
Ubuntunodejs26.0422.22.0+dfsg+~cs22.19.6-1ubuntu2vulnerable
Ubuntunodejs26.0422.22.0+dfsg+~cs22.19.13-2ubuntu1vulnerable
Ubuntunodejs26.0422.22.1+dfsg+~cs22.19.15-1ubuntu1vulnerable
Alpinenodejs3.2122.23.4-r0fixed
Alpinenodejs3.2222.23.4-r0fixed
Alpinenodejs3.2324.22.1-r0fixed
Alpinenodejs3.2424.22.1-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannodejssourcesid24.22.1+dfsg+~cs24.19.2-1not yet assignedNot reported[1151688]
Debiannodejssourceforky(unfixed)not yet assignedNot reported[1151688]
Debiannodejssourcetrixie(unfixed)not yet assignedNot reported[1151688]
Debiannodejssourcebookworm(unfixed)not yet assignedNot reported[1151688]
Alpinenodejsapk3.2122.23.4-r0Not reportedALPINE-CVE-2026-106074Not reported
Alpinenodejsapk3.2222.23.4-r0Not reportedALPINE-CVE-2026-106074Not reported
Alpinenodejsapk3.2324.22.1-r0Not reportedALPINE-CVE-2026-106074Not reported
Alpinenodejsapk3.2424.22.1-r0Not reportedALPINE-CVE-2026-106074Not reported

[Debian bug #1151688]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libnode108]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [libnode-dev]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [nodejs]Affected
    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [nodejs-doc]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

[Debian 13 (Trixie)]

  • [libnode115]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

  • [libnode-dev]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

  • [nodejs]Affected
    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

  • [nodejs-doc]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · all · trixie-security

      Affected

      dsa · nodejs · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]