# uuid (npm) vulnerabilities 2 known vulnerabilities (1 high, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 14.0.3 (Oct 10, 2026): no advisory affects it - Newest unaffected release: 14.0.3 (Oct 10, 2026), the latest release - Weekly downloads: 399.9M - Dependents: 49.8K - Releases: 56 since 0.0.1 (Mar 31, 2011) - Registry: https://www.npmjs.com/package/uuid - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-41907: 0.0.1 to 11.1.0 (11.1.1 is outside it); 12.0.0 (12.0.1 is outside it); 13.0.0 (13.0.1 is outside it) - CVE-2026-41988: 0.0.1 to 11.1.0 (11.1.1 is outside it); 12.0.0 (12.0.1 is outside it); 13.0.0 (13.0.1 is outside it) ## Advisories (2) ### [CVE-2026-41907](https://cve.now/CVE-2026-41907): uuid: Missing buffer bounds check in \`v3\`/\`v5\`/\`v6\` when \`buf\` is provided - Severity: High 8.1 - Published: Apr 24, 2026 - Affected: fixed in 11.1.1; from 12.0.0, fixed in 12.0.1; from 13.0.0, fixed in 13.0.1. - Fixed in 11.1.1 (released Apr 29, 2026, 5 days after disclosure), 12.0.1 (released Apr 29, 2026, 5 days after disclosure) and 13.0.1 (released Apr 29, 2026, 5 days after disclosure). - The latest release, 14.0.3, is not affected. - 69% of uuid downloads last week were affected versions (311.4M). ### [CVE-2026-41988](https://cve.now/CVE-2026-41988): uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. - Severity: Low 3.2 - Published: Apr 23, 2026 - Affected: fixed in 11.1.1; from 12.0.0, fixed in 12.0.1; from 13.0.0, fixed in 13.0.1. - Fixed in 11.1.1 (released Apr 29, 2026, 6 days after disclosure), 12.0.1 (released Apr 29, 2026, 6 days after disclosure) and 13.0.1 (released Apr 29, 2026, 6 days after disclosure). - The latest release, 14.0.3, is not affected. - 69% of uuid downloads last week were affected versions (311.4M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/uuid Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.