Executive brief
The 'uuid' library, a popular tool for generating unique identifiers in Node.js applications, contains a flaw where certain generator functions fail to verify if the provided memory buffer is large enough. This can lead to unexpected data writes or truncated identifiers without any error being raised. While the most common version of UUID (version 4) is unaffected, applications using versions 3, 5, or 6 could experience data integrity issues or logic errors if they rely on these specific functions.
Technical details
A missing buffer bounds check exists in the v3(), v5(), and v6() methods of the uuid library. When a caller provides an external output buffer (Uint8Array) with an insufficient size or an out-of-range offset, the library performs silent partial writes instead of throwing a RangeError. This behavior differs from the v1(), v4(), and v7() implementations which correctly validate buffer bounds. An attacker who can influence the offset or buffer size passed to these functions could cause memory corruption or application logic flaws due to malformed or truncated UUIDs. The issue is addressed in versions 11.1.1, 12.0.1, 13.0.1, and 14.0.0.
Affected products
- uuidjs uuid <11.1.1, 12.0.0, 13.0.0
Timeline
- 2026-04-19: patched: Fixes committed to repository
- 2026-04-19: advisory: GitHub Security Advisory published
- 2026-04-23: disclosed: CVE published to NVD