A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited · CVSS 4.8 Medium.
Data as of 10/25/2026, 12:14:30 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in– |
Description
A vulnerability exists in Node.js version 3.0 related to the internal entropy caches used by the crypto module's randomUUID() and randomUUIDv7() functions. This flaw involves improper handling of entropy, which may affect the randomness quality of UUID generation. No CVSS score or detailed impact information is provided. No patch or remediation details are available at this time.
Impact
The impact is related to the potential weakening of UUID randomness due to flawed entropy cache handling in Node.js crypto functions. This could affect security mechanisms relying on UUIDs for uniqueness or unpredictability. No confirmed exploitation or broader impact details are provided.
Weaknesses
- CWE-330Use of Insufficiently Random Values (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.