CVE-2026-106074 remediation checklist for Node.js maintainers

Release facts

CVE-2026-106074 affects Node.js 22.x, 24.x, and 26.x before versions 22.23.4, 24.22.1, and 26.12.1. Node.js rates the flaw medium, and the GitHub Advisory Database records CVSS 3.1 score 4.8.

The issue is tied to user-land startup snapshots and single executable applications that use useSnapshot. Internal entropy caches for crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be saved in the artifact.

Why a runtime check is not enough

The vulnerable state is produced during a build. If the build called an affected random function, later launches can repeat the cached values. Node.js documents up to 127 UUIDs and about 1,000 randomInt() values in the repeated segment.

A newer runtime can launch an old artifact without changing what the artifact already contains. Maintainers should inventory both the runtime and the snapshot or executable that will be distributed. Include archived downloads, previews, and recovery builds in the search.

Verification checklist

  1. Identify every build using --build-snapshot or producing a single executable with useSnapshot.
  2. Record the Node.js version used by that build.
  3. Search initialization code for crypto.randomUUID(), crypto.randomUUIDv7(), crypto.randomInt(), and URL.createObjectURL().
  4. Flag artifacts built with Node.js 22.x before 22.23.4, 24.x before 24.22.1, or 26.x before 26.12.1.
  5. Rebuild with a fixed release.
  6. Launch two isolated test processes from the new artifact and confirm that small synthetic identifiers differ.
  7. Replace binaries, hashes, signatures, and download references, then retire the old artifacts.

The test should use non-sensitive data. The objective is to verify cache behavior, not to generate a production credential.

Impact review

Repeated identifiers can corrupt records, merge telemetry, or make two processes appear to have the same object name. Prediction adds risk when one process's output can be observed and another process will consume the same cached sequence.

Review where early UUIDs or random integers are used. A display label may need cleanup after a collision. A secret, access token, or authorization value needs a stronger review and should not depend on an identifier whose uniqueness has been undermined.

The cited advisories report no confirmed exploitation. That keeps the immediate response focused on build inventory, artifact replacement, and evidence of duplicate values.

Affected scope

The affected release lines are 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1. The flaw does not apply merely because a Node.js product fingerprint is present. It requires the documented snapshot or single executable behavior.

Exposure context

ZoomEye Search app="Node.js" returned 5,539,619 matches. Filter vul.cve="CVE-2026-106074" returned 0. Exposure is 5,539,619 product fingerprints, not confirmed vulnerable artifacts.

Mitigation

The durable fix is to rebuild with Node.js 22.23.4, 24.22.1, 26.12.1, or later. Until rebuilds are complete, avoid the affected random APIs during snapshot creation and inspect existing artifacts for duplicate early values. Record the build version and artifact hash together so future audits do not repeat the same gap.

References