EUVD-2026-25190
GHSA-qmq6-f8pr-cx5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local code execution
-
DeliveryCall uuid version 3/5/6 generator
-
ExploitProvide undersized external buffer
-
ExecutionTrigger out-of-bounds write
-
ImpactCorrupt heap memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Always-incorrect control flow
|
| Exploitation Conditions | Exploitation requires all of the following: (1) local code execution within the same process running uuid library, (2) the application calling uuid generation for versions 3, 5, or 6 specifically (UUID version 4 is unaffected), (3) the application providing external pre-allocated buffers to uuid generation functions rather than using default internal allocation, and (4) the external buffer size not being validated or being smaller than expected UUID output (16 bytes). Applications using uuid version 4 (random UUID generation) with default buffer allocation are not vulnerable. Remote attack is not possible; this is a local privilege or logic attack only. |
| Impact | CVSS 3.2 with AV:L (local access required) and AC:H (high attack complexity) indicates low immediate risk. CVSS integrity impact (I:L) confirms memory corruption rather than confidentiality breach or availability loss. The scope change (S:C) suggests the impact can affect system confidentiality or availability indirectly, but the low base score reflects minimal practical exploitability. Critically, this vulnerability requires: (1) local attacker presence, (2) application actively using external buffers for UUID generation (non-default usage), and (3) UUID versions 3, 5, or 6 specifically. The widespread use of UUID version 4 (randomly generated, cryptographically secure) means most production applications are unaffected. No KEV status, POC availability, or EPSS score provided; absence of these signals combined with the narrow attack surface (local + non-default configuration + specific UUID versions) suggests low real-world exploitation likelihood. This is a valid but low-priority vulnerability for most deployments. |
| Exploit ScenarioDerived | A local attacker gains code execution within a Node.js application that uses uuid library version 3, 5, or 6 with externally managed buffers (for example, a Uint8Array pre-allocated for performance optimization). The attacker crafts input to the UUID generation function to trigger UUID version 3, 5, or 6 generation with an undersized buffer, causing the function to write beyond buffer boundaries and corrupt adjacent heap memory used by the application. This memory corruption could alter application state or bypass security checks, though achieving reliable code execution is difficult due to heap layout variability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 23, 2026
UUID library versions before 14.0.0 make unexpected writes to external output buffers when generating UUID versions 3, 5, or 6, potentially corrupting adjacent memory. UUID version 4, the most commonly deployed variant, is unaffected. The vulnerability requires local access and non-default buffer configuration to exploit, resulting in integrity compromise rather than code execution or availability impact.
RemediationAI
Vendor-released patch: upgrade uuid library to version 14.0.0 or later. For npm projects, run 'npm install uuid@^14.0.0' or update the dependency version in package.json and reinstall. Most applications using uuid version 4 (random UUIDs) can safely defer patching if buffer allocation is not externally controlled; however, applications using UUID versions 3, 5, or 6 with external pre-allocated buffers should prioritize immediate upgrade. If immediate upgrade is not feasible and the application uses external buffers for UUID generation, implement input validation to ensure buffer size matches expected UUID output length (16 bytes), or refactor code to use the library's default internal buffer allocation (which is not affected by this issue). The patch is available from the GitHub security advisory at https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq and commit 3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The uuid library (npm package uuidjs/uuid) is a JavaScript implementation for generating and parsing RFC 4122 compliant universally unique identifiers. The vulnerability exists in UUID generation functions for versions 3, 5, and 6 when callers provide external pre-allocated output buffers to write results into, rather than using default allocations. Version 3 (MD5-based namespace UUID), version 5 (SHA-1-based namespace UUID), and version 6 (timestamp-based) generation functions fail to properly respect buffer boundaries, causing writes beyond the intended region. This is a buffer handling issue (CWE-670: Always-Incorrect Control Flow Implementation) where the generation logic does not properly validate or constrain write operations to external buffers. UUID version 4 (random) and version 1 (timestamp-based) are not affected, likely because their generation paths use different write logic or have proper boundary checks.
Know when Uuid gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
Blast Radius
ecosystem impact- 17 npm packages depend on uuid (12 direct, 5 indirect)
Ecosystem-wide dependent count for version 12.0.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Buffer overwrite vulnerability in uuid JavaScript library versions prior to 14.0.0 enables remote attackers to corrupt m
A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630
Exploit-DB