Bug 2560016 (CVE-2026-106074)

Summary:	CVE-2026-106074 nodejs: nodejs: predictable random values via snapshot entropy cache reuse
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gtanzill, jbuscemi, kaycoth, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. If those APIs (or dependents such as URL.createObjectURL()) run while the snapshot is built, every process started from that snapshot can replay the same initial values until the cache is refilled (on the order of 127 UUIDs and about 1,000 randomInt values). Identifiers expected to be unique may collide across processes, and values from one process may be predictable to an observer of another process started from the same snapshot.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2560615, 2560617, 2560619, 2560621, 2560622, 2560623, 2560624
Bug Blocks:

Description OSIDB Bzimport 2026-10-23 16:21:49 UTC

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.

If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Comment 3 Jon Orris 2026-10-29 14:21:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:92376 https://access.redhat.com/errata/RHSA-2026:92376

Comment 4 Jon Orris 2026-10-29 22:29:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:92378 https://access.redhat.com/errata/RHSA-2026:92378