Quick answers
- Is CVE-2026-41907 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41907 being exploited in the wild.
- How severe is CVE-2026-41907?
- High severity, with a CVSS score of 7.5, published 24 April 2026.
- Which products and versions are affected?
- uuid (npm) SEMVER:introduced=0,fixed=11.1.1; Uuidjs Uuid < 11.1.1, >= 12.0.0 < 12.0.1, >= 13.0.0 < 13.0.1, <11.1.1, 12.0.0, 13.0.0.
- Is there a fix for CVE-2026-41907?
- Yes. uuid (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-41907 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-41907?
- Check whether you run uuid (npm) or Uuidjs Uuid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- uuid (npm): upgrade to 11.1.1 or later
npm install uuid@11.1.1
Technical details
The 'uuid' npm package lacks proper bounds validation in its v3, v5, and v6 API implementations when a caller provides a custom output buffer and offset. While other versions (v1, v4, v7) throw a RangeError if the buffer is too small or the offset is out of range, these specific methods perform silent partial writes. This is an out-of-bounds write vulnerability (CWE-787) occurring in src/v35.ts and src/v6.ts. An attacker who can influence the buffer size or offset passed to these functions could cause the application to operate on truncated or malformed UUIDs, potentially leading to logic flaws or identifier collisions. Patches are available in versions 11.1.1, 12.0.1, and 13.0.1.
Affected products
- uuidjs uuid < 11.1.1, >= 12.0.0 < 12.0.1, >= 13.0.0 < 13.0.1
Identifiers
- CVE-2026-41907
- GHSA-w5hq-g745-h8pq
Timeline
- 2026-04-19: disclosed
- 2026-04-22: advisory
- 2026-04-24: other: NVD published