AZL-111050

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111050.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-111050
Upstream
  • CVE-2026-106074
Published
2026-10-23T17:17:20Z
Modified
2026-10-27T05:36:16Z
Summary
CVE-2026-106074 affecting package nodejs 24.21.0-1
Details

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot.

If any of these functions, or an API that relies on them such as URL.createObjectURL(), is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 randomInt() values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

References

Affected packages

Azure Linux:3 / nodejs

Package

Name
nodejs
Purl
pkg:rpm/azure-linux/nodejs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
24.21.0-1

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111050.json"