CVE-2026-41907: uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-24 · updated 2026-10-26
Weakness: CWE-787

Description

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

Affected products

uuidjs uuid: before 11.1.1; 12.0.0, 13.0.0 — fixed in 11.1.1
Npm Uuid: before 11.1.1; from 12.0.0 before 12.0.1; from 13.0.0 before 13.0.1 — fixed in 11.1.1, 12.0.1, 13.0.1

How to fix

Upgrade to a fixed version: uuidjs uuid 11.1.1; Npm Uuid 11.1.1, 12.0.1, 13.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41907 or the next vulnerability affects your stack