Skip to main content
cve.nowby Sazabi
← npm
npmPackage

uuid

2 known vulnerabilities (1 high, 1 low), with the versions each affects and the releases that fix them.

Latest release
14.0.3 (Oct 10, 2026): no advisory affects it
Newest unaffected release
14.0.3 (Oct 10, 2026), the latest release
Advisories
2 · 1 high, 1 low
Weekly downloads
399.9M
Dependents
49.8K
Releases
56 since 0.0.1 (Mar 31, 2011)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-41907
    Affects 0.0.1 to 11.1.0 (11.1.1 is outside it); 12.0.0 (12.0.1 is outside it); 13.0.0 (13.0.1 is outside it)
  • CVE-2026-41988
    Affects 0.0.1 to 11.1.0 (11.1.1 is outside it); 12.0.0 (12.0.1 is outside it); 13.0.0 (13.0.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

    Affected: fixed in 11.1.1; from 12.0.0, fixed in 12.0.1; from 13.0.0, fixed in 13.0.1.

    Fixed in 11.1.1 (released Apr 29, 2026, 5 days after disclosure), 12.0.1 (released Apr 29, 2026, 5 days after disclosure) and 13.0.1 (released Apr 29, 2026, 5 days after disclosure).

    The latest release, 14.0.3, is not affected.

    69% of uuid downloads last week were affected versions (311.4M).

  • uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6.

    Affected: fixed in 11.1.1; from 12.0.0, fixed in 12.0.1; from 13.0.0, fixed in 13.0.1.

    Fixed in 11.1.1 (released Apr 29, 2026, 6 days after disclosure), 12.0.1 (released Apr 29, 2026, 6 days after disclosure) and 13.0.1 (released Apr 29, 2026, 6 days after disclosure).

    The latest release, 14.0.3, is not affected.

    69% of uuid downloads last week were affected versions (311.4M).