Bug 2560016 (CVE-2026-106074) - CVE-2026-106074 nodejs: nodejs: predictable random values via snapshot entropy cache reuse
Summary: CVE-2026-106074 nodejs: nodejs: predictable random values via snapshot entrop...
Keywords:
Status: NEW
Alias: CVE-2026-106074
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2560615 2560617 2560619 2560621 2560622 2560623 2560624
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-23 16:21 UTC by OSIDB Bzimport
Modified: 2026-10-26 11:50 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-23 16:21:49 UTC 
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.

If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Note You need to log in before you can comment on or make changes to this bug.