Threats affecting pkg:npm/uuid

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

The uuidjs library versions before 14.0.0 contain a vulnerability (CVE-2026-41988) where unexpected writes can occur when using external output buffers with UUID versions 3, 5, or 6. This issue does not affect the commonly used UUID version 4. The vulnerability is classified under CWE-670, indicating always-incorrect control flow implementation. The CVSS score is low (3.2), reflecting limited impact and complexity in exploitation. No known exploits are reported in the wild, and no official patch or remediation guidance is currently available from the vendor.