ALPINE-CVE-2026-106074
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-106074
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-106074.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-106074
- Upstream
- CVE-2026-106074
- Published
- 2026-10-23T17:17:20Z
- Modified
- 2026-10-24T09:30:02Z
- Severity
-
- 4.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw in Node.js
cryptocauses the internal entropy caches used bycrypto.randomUUID(),crypto.randomUUIDv7(), andcrypto.randomInt()to be saved into user-land startup snapshots (--build-snapshot) and single executable applications built withuseSnapshot.If any of these functions, or an API that relies on them such as
URL.createObjectURL(), is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000randomInt()values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- References
Affected packages
Alpine:v3.21 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:apk/alpine/nodejs?arch=source
Alpine:v3.22 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:apk/alpine/nodejs?arch=source
Alpine:v3.23 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:apk/alpine/nodejs?arch=source