BIT-node-min-2026-106074

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/node-min/BIT-node-min-2026-106074.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-node-min-2026-106074
Aliases
Published
2026-10-29T08:56:16Z
Modified
2026-10-29T10:56:12Z
Summary
[none]
Details

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot.

If any of these functions, or an API that relies on them such as URL.createObjectURL(), is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 randomInt() values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Medium"
}
References

Affected packages

Bitnami / node-min

Package

Name
node-min
Purl
pkg:bitnami/node-min

Severity

  • 4.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
22.23.4
Introduced
23.0.0
Fixed
24.22.1
Introduced
25.0.0
Fixed
26.12.1

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/node-min/BIT-node-min-2026-106074.json"