CVE-2026-106074: CWE-330 Use of Insufficiently Random Values in nodejs node

CVE-2026-106074 is a vulnerability in Node.js where the internal entropy caches for crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() are saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. When these functions or dependent APIs like URL.createObjectURL() are invoked during snapshot creation, the cached random values are reused in every process started from that snapshot until the cache is refilled. This results in up to 127 UUIDs and about 1,000 randomInt() values being identical across processes, leading to collisions of identifiers expected to be unique and predictability of values across processes. The affected versions are Node.js 22.23.3, 24.22.0, and 26.12.0.

The vulnerability causes identifiers that should be unique, such as UUIDs and random integers generated by the affected crypto functions, to collide across processes spawned from the same snapshot. Additionally, values generated by one process can be predicted by observing another process, reducing randomness and potentially undermining security mechanisms relying on these values. The CVSS score is 4.8 (medium severity), indicating limited confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid calling crypto.randomUUID(), crypto.randomUUIDv7(), crypto.randomInt(), or APIs relying on them during snapshot creation with --build-snapshot or useSnapshot. Consider rebuilding snapshots without invoking these functions or avoid using snapshots if possible.