CVE-2026-41988: uuidjs uuid missing buffer bounds check in v3, v5, and v6 methods

CVE-2026-41988 · Severity: low · CVSS 3.2 · Published 2026-04-23

The 'uuid' library, a popular tool for generating unique identifiers in Node.js applications, contains a flaw where certain generator functions fail to verify if the provided memory buffer is large enough. This can lead to unexpected data writes or truncated identifiers without any error being raised. While the most common version of UUID (version 4) is unaffected, applications using versions 3, 5, or 6 could experience data integrity issues or logic errors if they rely on these specific functions.

Technologies: Uuidjs Uuid. Vendors: Uuidjs.

Quick answers

Is CVE-2026-41988 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41988 being exploited in the wild.
How severe is CVE-2026-41988?
Low severity, with a CVSS score of 3.2, published 23 April 2026.
Which products and versions are affected?
Uuidjs Uuid <11.1.1, 12.0.0, 13.0.0.
Is there a fix for CVE-2026-41988?
A patch was published on 2026-04-19: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41988 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-41988?
Check whether you run Uuidjs Uuid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing buffer bounds check exists in the v3(), v5(), and v6() methods of the uuid library. When a caller provides an external output buffer (Uint8Array) with an insufficient size or an out-of-range offset, the library performs silent partial writes instead of throwing a RangeError. This behavior differs from the v1(), v4(), and v7() implementations which correctly validate buffer bounds. An attacker who can influence the offset or buffer size passed to these functions could cause memory corruption or application logic flaws due to malformed or truncated UUIDs. The issue is addressed in versions 11.1.1, 12.0.1, 13.0.1, and 14.0.0.

Affected products

  • uuidjs uuid <11.1.1, 12.0.0, 13.0.0

Timeline

  • 2026-04-19: patched: Fixes committed to repository
  • 2026-04-19: advisory: GitHub Security Advisory published
  • 2026-04-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.