Executive brief
The 'uuid' library, a popular tool for generating unique identifiers in JavaScript applications, contains a flaw in how it handles custom memory buffers. When generating certain types of IDs (v3, v5, and v6), the library fails to check if the provided buffer is large enough, which can lead to incomplete or corrupted identifiers being written without any error message. This could cause data integrity issues or logic errors in systems that rely on these identifiers for security or record-keeping.
Technical details
The 'uuid' npm package lacks proper bounds validation in its v3, v5, and v6 API implementations when a caller provides a custom output buffer and offset. While other versions (v1, v4, v7) throw a RangeError if the buffer is too small or the offset is out of range, these specific methods perform silent partial writes. This is an out-of-bounds write vulnerability (CWE-787) occurring in src/v35.ts and src/v6.ts. An attacker who can influence the buffer size or offset passed to these functions could cause the application to operate on truncated or malformed UUIDs, potentially leading to logic flaws or identifier collisions. Patches are available in versions 11.1.1, 12.0.1, and 13.0.1.
Affected products
- uuidjs uuid < 11.1.1, >= 12.0.0 < 12.0.1, >= 13.0.0 < 13.0.1
Timeline
- 2026-04-19: disclosed
- 2026-04-22: advisory
- 2026-04-24: other: NVD published