Cloudanix VulnDB

CVE-2026-106074

Medium · 4.8

CVSS

4.8

EPSS

0.3%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Some Node.js programs that package themselves into a single file can accidentally reuse the same random numbers or IDs across separate copies, making those IDs easier to guess or duplicate.

Chainable
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
Cryptographic Weakness
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Entropy caches for crypto.randomUUID, randomUUIDv7, and randomInt are persisted into startup snapshots, causing all child processes to emit identical sequences of up to 127 UUIDs and roughly 1,000 random integers until the cache is exhausted.

Why it matters to the business

Systems that rely on snapshot-built single-executable applications or startup snapshots may generate duplicate identifiers or predictable random values across multiple running instances, undermining uniqueness guarantees used for tokens, session IDs, and object references.

How an attack unfolds

An attacker first obtains or reconstructs a snapshot that was built after any of the affected random functions were invoked, then launches multiple processes from that snapshot while observing the emitted values to either force collisions or predict future outputs in other instances.

How to fix it

Upgrade Node.js 22.x, 24.x, and 26.x to the latest patch releases that prevent entropy cache serialization into user-land snapshots; rebuild all single-executable applications and startup snapshots after upgrading.

How to confirm the fix worked

After upgrade and snapshot rebuild, launch multiple processes from the snapshot and confirm that generated UUIDs and random integers differ across instances; inspect snapshot contents for absence of cached entropy data.

Typical attack path

  1. Identify applications distributed as Node.js single-executable binaries or using --build-snapshot
  2. Trigger snapshot creation after randomUUID/randomInt calls have occurred
  3. Launch multiple instances from the same snapshot image
  4. Collect and compare generated identifiers across instances to detect reuse or predict subsequent values

How to detect it

Review build logs and snapshot generation scripts for invocations of randomUUID, randomInt, or URL.createObjectURL immediately prior to snapshot creation; inspect resulting binaries or snapshot files for repeated identifier patterns across multiple runtime instances.

What your security team should do

  • Prioritize upgrade of Node.js runtimes used for snapshot or SEA builds within the next 7 days given recent publication
  • Rebuild and redeploy all affected single-executable applications and snapshot-based deployments
  • Audit codebases for calls to randomUUID, randomInt, or dependent APIs during snapshot construction
  • Monitor EPSS trend and reassess exploit maturity weekly until patches are widely adopted

The record

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities