CVE-2026-41988

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.

CVSS v3 3.2 LOW

3.2^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34	Patch
https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq	Exploit Vendor Advisory
https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:uuidjs:uuid::::::node.js::*
	cpe:2.3:a:uuidjs:uuid:12.0.0:::::node.js::
	cpe:2.3:a:uuidjs:uuid:13.0.0:::::node.js::

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) uuid anterior a 14.0.0 puede realizar escrituras inesperadas cuando se utilizan búferes de salida externos y la versión de UUID es 3, 5 o 6. En particular, la versión 4 de UUID, que es muy utilizada, no se ve afectada por este problema.

Information

Published : 2026-04-23 05:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41988

Mitre link : CVE-2026-41988

CVE.ORG link : CVE-2026-41988

JSON object : View

Products Affected

uuidjs

uuid

CWE

CWE-670

Always-Incorrect Control Flow Implementation

NVD-CWE-noinfo

{"id": "CVE-2026-41988", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41988", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T14:48:49.689201Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.0}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "uuidjs", "product": "uuid", "versions": [{"status": "affected", "version": "0", "lessThan": "14.0.0", "versionType": "semver"}], "packageURL": "pkg:npm/uuid", "defaultStatus": "unaffected"}]}], "published": "2026-04-23T05:16:05.613", "references": [{"url": "https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-670"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue."}, {"lang": "es", "value": "uuid anterior a 14.0.0 puede realizar escrituras inesperadas cuando se utilizan b\u00faferes de salida externos y la versi\u00f3n de UUID es 3, 5 o 6. En particular, la versi\u00f3n 4 de UUID, que es muy utilizada, no se ve afectada por este problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uuidjs:uuid:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B8AA79D0-36C1-44C8-BB22-29113130D2DA", "versionEndExcluding": "11.1.1"}, {"criteria": "cpe:2.3:a:uuidjs:uuid:12.0.0:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "989A818E-3B12-4BA1-8311-C2C4237B3E47"}, {"criteria": "cpe:2.3:a:uuidjs:uuid:13.0.0:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "88125146-C07D-4469-86AC-447F215418F1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}