{"id":"CVE-2026-106074","aliases":[],"cve":{"records":[{"id":"CVE-2026-106074","source":"hackerone","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-06T15:00:00.655Z","published":"2026-10-23T16:15:05.829Z","modified":"2026-11-02T15:48:44.599Z"}],"publishers":[{"name":"hackerone","role":"CNA","organizationId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","modified":"2026-10-23T16:15:05.829Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-02T15:48:44.599Z"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","tags":[],"source":"hackerone"}],"weaknesses":[{"id":"CWE-330","description":"CWE-330 Use of Insufficiently Random Values","source":"hackerone"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-02T15:43:34.777507Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into…","titleSource":"hackerone","descriptionSource":"hackerone","description":"A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.\n\nIf any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","score":4.8,"severity":"medium","published":"2026-10-23T16:15:05.829Z","modified":"2026-11-02T15:48:44.599Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"nodejs","name":"node","platforms":[],"versions":[{"version":"22.23.3","status":"affected","lessThanOrEqual":"22.23.3","versionType":"semver"},{"version":"24.22.0","status":"affected","lessThanOrEqual":"24.22.0","versionType":"semver"},{"version":"26.12.0","status":"affected","lessThanOrEqual":"26.12.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"hackerone","url":"https://www.cve.org/CVERecord?id=CVE-2026-106074"}],"remediation":[],"references":["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"],"sources":[{"name":"CVE","id":"CVE-2026-106074","modified":"2026-11-02T15:48:44.599Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-106074"}],"assessments":[{"source":"hackerone","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8}],"sourceAffected":[],"observedAt":"2026-11-02T15:55:41.107Z","kev":{"status":"not-listed","checkedAt":"2026-11-05T11:05:32.134Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-02T16:05:38.682Z","attemptedAt":"2026-11-02T16:05:38.682Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-02T16:05:38.998Z","attemptedAt":"2026-11-02T16:05:38.998Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-02T16:05:39.007Z","attemptedAt":"2026-11-02T16:05:39.007Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-02T16:05:38.100Z","attemptedAt":"2026-11-02T16:05:38.100Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-106074","url":"https://www.first.org/epss/","probability":0.00334,"percentile":0.26781,"date":"2026-11-02","checkedAt":"2026-11-02T16:05:38.100Z"},{"source":"NVD","id":"CVE-2026-106074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106074","modified":"2026-10-23T19:42:24.553","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-11-02T16:05:38.682Z"},{"source":"GitHub Advisory Database","id":"GHSA-w3gx-6c8w-v66f","url":"https://github.com/advisories/GHSA-w3gx-6c8w-v66f","modified":"2026-10-23T18:31:40Z","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-11-02T16:05:38.998Z"},{"source":"ENISA EUVD","id":"EUVD-2026-109104","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109104","modified":"Oct 23, 2026, 4:15:05 PM","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-11-02T16:05:39.007Z"}],"aiSummary":{"text":"A flaw in Node.js crypto causes internal entropy caches to be saved, potentially leading to identifier collisions and predictable values. This affects Node.js versions 22.x, 24.x, and 26.x. An attacker with access to a process started from a snapshot may predict values issued by another process.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-02T15:56:08.213Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-106074"}]}}