CVE-2026-106074: Node.js crypto entropy cache reuse in snapshots

CVE-2026-106074 · Severity: medium · CVSS 4.8 · Published 2026-10-23

Node.js includes a cryptographic random number generator used by functions like randomUUID() and randomInt(). When applications are packaged as snapshots or single executable applications using Node.js's snapshot feature, the cached random values are frozen into the snapshot and reused across every process started from it, causing UUIDs and random integers to repeat identically across multiple processes instead of being unique.

Technologies: OpenJS Foundation Node.js. Vendors: OpenJS Foundation.

Quick answers

Is CVE-2026-106074 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106074 being exploited in the wild.
How severe is CVE-2026-106074?
Medium severity, with a CVSS score of 4.8, published 23 October 2026.
Which products and versions are affected?
OpenJS Foundation Node.js 22.x, 24.x, 26.x.
Is there a fix for CVE-2026-106074?
Yes: fixed in Node.js v22.23.4, v24.22.1, v26.12.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106074 attacked?
It is attacked with local access.
Am I affected by CVE-2026-106074?
Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Node.js v22.23.4, v24.22.1, v26.12.1

Technical details

The vulnerability exists in Node.js crypto functions that populate internal entropy caches during snapshot creation. If crypto.randomUUID(), crypto.randomUUIDv7(), or crypto.randomInt() are called while building a snapshot (--build-snapshot), the cached values are serialized into the snapshot and reused on each invocation, allowing up to 127 identical UUIDs and ~1,000 identical randomInt() values per process. Attack vectors include any API relying on these functions, such as URL.createObjectURL(). An attacker observing output from one process can predict values from others, or exploit colliding identifiers.

Affected products

  • OpenJS Foundation Node.js 22.x, 24.x, 26.x

Timeline

  • 2026-10-21: disclosed
  • 2026-10-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.