From predictable IDs to workflow risk: analyzing Node.js CVE-2026-106074

The issue in one paragraph

CVE-2026-106074 can cause Node.js startup snapshots to contain cached values from crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt(). Processes launched from the same snapshot may repeat those values until the cache refills. The vulnerability affects Node.js 22.x, 24.x, and 26.x before fixed releases 22.23.4, 24.22.1, and 26.12.1.

Mechanism and reachability

The relevant build modes are user-land startup snapshots made with --build-snapshot and single executable applications built with useSnapshot. If application initialization calls an affected random API during the snapshot build, the remaining cached sequence can be saved.

The advisory describes repetition of up to 127 UUIDs and about 1,000 outputs from randomInt(). A cache refill changes later output. The issue is therefore most visible in values created early in each process, especially when multiple processes are launched from the same artifact.

URL.createObjectURL() is one indirect path. It matters because application code may use object URLs for ordinary file handling without intending to create a security identifier. Build-time execution is the pivot: the API has to affect the cache state that later gets captured.

Turning repetition into business risk

Start with data flow. Where is the UUID stored? Is it a primary key, an upload path, a trace ID, or an authorization value? Who can observe it? What happens if two records share it?

For a public correlation ID, duplicate values can confuse support and incident reconstruction. For a write key, they can collapse independent objects. For a capability, predictability may allow an observer of one process to anticipate another process's value. Each case has a different severity even though the underlying sequence is the same.

The GitHub Advisory Database assigns CVSS 3.1 4.8, with high attack complexity and low confidentiality and integrity impact. The Node.js project rates the issue medium. No confirmed exploitation appears in the source material, so the response should be driven by actual exposure and value use.

Affected scope and exposure

The affected source releases are Node.js 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1. Snapshot artifacts created by those releases require attention even when a newer runtime is now available.

ZoomEye Search app="Node.js" returned 5,539,619 matches. The selected CVE Filter returned 0. Exposure is 5,539,619 product matches, not confirmed affected processes or vulnerable builds.

Response

Upgrade builders to 22.23.4, 24.22.1, 26.12.1, or later. Rebuild snapshots and embedded-snapshot executables, replace distributed artifacts, and verify that new processes produce distinct early identifiers.

For temporary containment, prevent the affected APIs from running while a snapshot is assembled. Review artifacts that were already generated and avoid treating their early UUIDs as unique or secret. This analysis should feed a focused data-integrity check rather than a blanket incident declaration.

References