CVE-2026-41988

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.

CVSS v3 3.2 LOW

3.2^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34	Patch
https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq	Exploit Vendor Advisory
https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:uuidjs:uuid::::::node.js::*
	cpe:2.3:a:uuidjs:uuid:12.0.0:::::node.js::
	cpe:2.3:a:uuidjs:uuid:13.0.0:::::node.js::

History

No history.

Information

Published : 2026-04-23 05:16

Updated : 2026-07-08 03:27

NVD link : CVE-2026-41988

Mitre link : CVE-2026-41988

CVE.ORG link : CVE-2026-41988

JSON object : View

Products Affected

uuidjs

uuid

CWE

CWE-670

Always-Incorrect Control Flow Implementation

NVD-CWE-noinfo

{"id": "CVE-2026-41988", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41988", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T14:48:49.689201Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.0}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "uuidjs", "product": "uuid", "versions": [{"status": "affected", "version": "0", "lessThan": "14.0.0", "versionType": "semver"}], "packageURL": "pkg:npm/uuid", "defaultStatus": "unaffected"}]}], "published": "2026-04-23T05:16:05.613", "references": [{"url": "https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-670"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue."}], "lastModified": "2026-07-08T03:27:35.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uuidjs:uuid:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B8AA79D0-36C1-44C8-BB22-29113130D2DA", "versionEndExcluding": "11.1.1"}, {"criteria": "cpe:2.3:a:uuidjs:uuid:12.0.0:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "989A818E-3B12-4BA1-8311-C2C4237B3E47"}, {"criteria": "cpe:2.3:a:uuidjs:uuid:13.0.0:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "88125146-C07D-4469-86AC-447F215418F1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}