BIT-node-min-2026-106074: Medium severity bitnami/node vulnerability

Q: Which deployments are exposed to this issue?

Deployments using Node.js 22.x, 24.x, or 26.x are exposed when they start from a user-land startup snapshot built with --build-snapshot, or from a single executable application built with useSnapshot. The issue applies only if affected random-value APIs were invoked while that snapshot was created.

Q: What must happen for values to be repeated or predictable across processes?

crypto.randomUUID(), crypto.randomUUIDv7(), crypto.randomInt(), or an API relying on them such as URL.createObjectURL(), must be called during snapshot creation. The resulting snapshot preserves the internal entropy cache, causing each process started from it to initially use the same cached values.

Q: What is the practical impact of a reused entropy cache?

Up to 127 UUIDs and approximately 1,000 randomInt() results can repeat between processes started from the same snapshot, until the cache is refilled. This can create collisions in identifiers expected to be unique and allow values issued by one process to be predicted by observing another.

Q: How can I determine whether an application is likely affected?

Check whether the application uses --build-snapshot or is packaged as a single executable with useSnapshot. Then determine whether the snapshot-building code invokes the affected crypto functions or dependent APIs such as URL.createObjectURL().

Published Oct 29, 2026

Updated

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() to be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot.

If any of these functions, or an API that relies on them such as URL.createObjectURL(), is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 randomInt() values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Affected Software

6 affected componentsFixes available

bitnami/node<22.23.4

22.23.4

bitnami/node>=23.0.0<24.22.1

24.22.1

bitnami/node>=25.0.0<26.12.1

26.12.1

bitnami/node-min<22.23.4

22.23.4

bitnami/node-min>=23.0.0<24.22.1

24.22.1

bitnami/node-min>=25.0.0<26.12.1

26.12.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 22.23.4
Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 26.12.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 22.23.4
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 26.12.1

Event History

Oct 29, 2026

Advisory Published

via OSV·08:56 AM

Data Sourced

via OSV·08:56 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Node.js 22.x, 24.x, or 26.x are exposed when they start from a user-land startup snapshot built with --build-snapshot, or from a single executable application built with useSnapshot. The issue applies only if affected random-value APIs were invoked while that snapshot was created.

What must happen for values to be repeated or predictable across processes?

crypto.randomUUID(), crypto.randomUUIDv7(), crypto.randomInt(), or an API relying on them such as URL.createObjectURL(), must be called during snapshot creation. The resulting snapshot preserves the internal entropy cache, causing each process started from it to initially use the same cached values.

What is the practical impact of a reused entropy cache?

Up to 127 UUIDs and approximately 1,000 randomInt() results can repeat between processes started from the same snapshot, until the cache is refilled. This can create collisions in identifiers expected to be unique and allow values issued by one process to be predicted by observing another.

How can I determine whether an application is likely affected?

Check whether the application uses --build-snapshot or is packaged as a single executable with useSnapshot. Then determine whether the snapshot-building code invokes the affected crypto functions or dependent APIs such as URL.createObjectURL().

BIT-node-min-2026-106074: Medium severity bitnami/node vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must happen for values to be repeated or predictable across processes?

What is the practical impact of a reused entropy cache?

How can I determine whether an application is likely affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must happen for values to be repeated or predictable across processes?

What is the practical impact of a reused entropy cache?

How can I determine whether an application is likely affected?