CVE-2026-106074
Description
A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. If those APIs (or dependents such as URL.createObjectURL()) run while the snapshot is built, every process started from that snapshot can replay the same initial values until the cache is refilled (on the order of 127 UUIDs and about 1,000 randomInt values). Identifiers expected to be unique may collide across processes, and values from one process may be predictable to an observer of another process started from the same snapshot.
Statement
This is a Moderate severity flaw. Red Hat rates it Moderate because impact is limited to confidentiality and integrity of early pseudo-random values (Low/Low) and exploitation requires building or distributing a startup snapshot or SEA with useSnapshot after exercising the affected APIs (high attack complexity; non-default deployment pattern). Typical Red Hat Node.js RPM and service deployments that do not ship custom snapshots are less exposed in practice, but the vulnerable code is present in affected Node.js streams. OS-level hardening does not reset Node/V8 entropy caches across snapshot restore.
Mitigation
Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation.
Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | 4.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat CVSS v3 Score Explanation
Aligned with CNA. AC:H — only SEAs/useSnapshot or --build-snapshot workflows that captured entropy caches. C:L/I:L for limited repeated UUID/randomInt window. Platform hardening does not reset JS entropy caches on snapshot restore.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
