The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade v8-13.6-devel | Nov 1, 2026 | Oct 29, 2026 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Oct 28, 2026 | Oct 23, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22Upgrade v8-13.6-develUpgrade nodejs24-develUpgrade v8-12.4-develUpgrade nodejs22-full-i18nUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs24Upgrade nodejs24-npmUpgrade nodejs22-docsUpgrade nodejs24-debugsourceUpgrade nodejs22-npmUpgrade nodejs22-develUpgrade nodejs24-full-i18nUpgrade nodejs22-libsUpgrade nodejs24-docsUpgrade nodejs22-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-libs | Oct 28, 2026 | Oct 23, 2026 |
| Nodejs | — | Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later | Oct 28, 2026 | Oct 23, 2026 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade v8-13.6-develUpgrade nodejsUpgrade nodejs-devel | Nov 2, 2026 | Oct 23, 2026 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade v8-13.6-develUpgrade nodejsNo solution exists | Oct 27, 2026 | Oct 23, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub