CVE-2026-41907: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
(updated )
The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.
This inconsistency allows silent partial writes into caller-provided buffers.
References
- github.com/advisories/GHSA-w5hq-g745-h8pq
- github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e
- github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34
- github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d
- github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a
- github.com/uuidjs/uuid/releases/tag/v11.1.1
- github.com/uuidjs/uuid/releases/tag/v12.0.1
- github.com/uuidjs/uuid/releases/tag/v13.0.1
- github.com/uuidjs/uuid/releases/tag/v14.0.0
- github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq
- nvd.nist.gov/vuln/detail/CVE-2026-41907
Code Behaviors & Features
Detect and mitigate CVE-2026-41907 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →