Skip to content
OpenAdvisories
High · 8.1 CVE-2026-41907 CVE-2026-41988EUVD-2026-25600GHSA-w5hq-g745-h8pq

uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

Published Apr 24, 2026 · Updated Apr 27, 2026 · Assigned by GitHub_M

Vendor: uuidjs Product: uuid Package: argo-workflows-ui-4.0 Package: code-server Package: jitsucom-jitsu-console Package: jupyter-base-notebook Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kubeflow-centraldashboard Package: kubeflow-pipelines-frontend Package: langfuse-3 Package: langfuse-3-worker Package: nextcloud-server-33 Package: node-uuid Package: node-uuid Package: npm Package: opensearch-dashboards-3 Package: opensearch-dashboards-3-dashboards-maps Package: opensearch-dashboards-3-dashboards-observability Package: opensearch-dashboards-3-dashboards-reporting Package: opensearch-dashboards-3-security-analytics-dashboards-plugin Package: prism Package: py3.10-jupyterlab Package: py3.11-jupyterlab Package: py3.12-jupyterlab Package: py3.13-jupyterlab Package: renovate Package: saf Package: sqlpad Package: uuid Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu Ecosystem: Wolfi

Description

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

Affected products

VendorProductAffectedFixed
uuidjs uuid < 14.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-uuid 14.0.0+~11.0.0-1 —
Debian 13 node-uuid No fix yet —
Debian 12 node-uuid No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-uuid No fix yet —
Ubuntu 26.04 LTS node-uuid No fix yet —
Ubuntu 25.10 node-uuid No fix yet —
Ubuntu 24.04 LTS node-uuid No fix yet —
Ubuntu 22.04 LTS node-uuid No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS node-uuid No fix yet —
Ubuntu 18.04 LTS node-uuid No fix yet —
Ubuntu 16.04 LTS node-uuid No fix yet —
Ubuntu 14.04 LTS node-uuid No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling argo-workflows-ui-4.0 4.0.5-r0 —
Wolfi rolling code-server 4.112.0-r3 —
Wolfi rolling jitsucom-jitsu-console 2.11.0-r23 —
Wolfi rolling jupyter-base-notebook 7.6.3-r2 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kubeflow-centraldashboard 1.10.0-r20 —
Wolfi rolling kubeflow-pipelines-frontend 2.16.0-r19 —
Wolfi rolling langfuse-3 +1 3.164.0-r7 —
Wolfi rolling nextcloud-server-33 33.0.6-r9 —
Wolfi rolling npm 11.13.0-r1 —
Wolfi rolling opensearch-dashboards-3 +4 3.6.0-r2 —
Wolfi rolling prism 5.15.9-r0 —
Wolfi rolling py3.10-jupyterlab +3 4.6.1-r1 —
Wolfi rolling renovate 43.166.2-r0 —
Wolfi rolling saf 1.6.0-r0 —
Wolfi rolling sqlpad 7.5.7-r17 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm uuid < 11.1.1 11.1.1 GHSA-w5hq-g745-h8pq
npm uuid >= 12.0.0, < 12.0.1 12.0.1 GHSA-w5hq-g745-h8pq
npm uuid >= 13.0.0, < 13.0.1 13.0.1 GHSA-w5hq-g745-h8pq

Advisories 3

References