Most severe vulnerabilities for "npm/uuid"

Where

Sort:

npm/uuiduuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

Risk 80

Severity

8.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

First published (updated )

CVE-2026-41907

npm/uuiduuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID ve…

Risk 18

Severity

3.2

AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.

First published (updated )

CVE-2026-41988

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Trending

npm/uuiduuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

npm/uuiduuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID ve…

Company

Resources

Contact