Assessing uniqueness failures after Node.js snapshots preserve entropy caches
Vulnerability overview
Applications usually treat a UUID as a practical guarantee of uniqueness. CVE-2026-106074 challenges that expectation for Node.js processes launched from certain snapshots and single executable applications.
The issue affects Node.js 22.x, 24.x, and 26.x before 22.23.4, 24.22.1, and 26.12.1. It is rated medium. The problem concerns cached values belonging to crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt().
Mechanism and conditions
When a user-land startup snapshot is built with a vulnerable Node.js release, internal entropy caches can be captured in the snapshot. A single executable application built with useSnapshot carries the same kind of state.
The condition becomes observable when one of the affected APIs is called during snapshot construction. Each later process can start with the same cached sequence. The advisory limits the described repetition to 127 UUIDs and about 1,000 randomInt() values, after which a refill produces new values.
An application can also reach the cache through URL.createObjectURL(). Code search should include dependency and framework paths, not only first-party functions named in the advisory.
Impact
Uniqueness failures can be quiet. Two processes may write a record under the same UUID, causing one write to replace another. A distributed trace may combine unrelated requests. An audit entry may point to the wrong object. These outcomes affect integrity without requiring an attacker to guess a secret.
Prediction becomes relevant when an observer can watch one process's generated values and another process from the same artifact is still consuming the shared cache. The affected data might then be anticipated before it is used. Whether that creates a security event depends on the value's role.
Do not classify every UUID as a credential. Also do not dismiss a repeated UUID because it is "only an identifier." Review the systems that accept it as input, store it, or use it to authorize access.
Affected configuration
The vulnerable releases cover three active Node.js lines before their fixed patches. The affected behavior requires snapshot construction or useSnapshot with an affected runtime. The source documents do not claim that ordinary Node.js processes without such artifacts repeat these values.
Exposure context
ZoomEye Search app="Node.js" returned 5,539,619 matches. Filter vul.cve="CVE-2026-106074" returned 0. Exposure is 5,539,619, representing broad product fingerprints rather than confirmed vulnerable snapshots.
Remediation and validation
Upgrade build environments to Node.js 22.23.4, 24.22.1, 26.12.1, or a later fixed release. Rebuild the snapshot or single executable application and replace the old artifact. A launcher upgrade alone does not change state already frozen into a file.
For validation, create two clean processes from the rebuilt artifact and initialize them through the same code path used in production. Record whether the first identifiers differ. Use synthetic test data and avoid publishing any generated security-sensitive value.
Until the rebuild is complete, look for duplicate identifiers created after process start in logs and object stores. Where the values can be observed by untrusted users, treat them as potentially predictable and avoid using them as authorization secrets.
