CVE-2026-41907: uuidjs uuid

Vulnerability summary

CVE-2026-41907 is a high (CVSS 8.1) vulnerability in uuidjs uuid. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-04-2026
   PublishedVulnerability first disclosed.
2. 27-04-2026
   Last modifiedVulnerability information updated.

Description

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

• CWE-670Always-Incorrect Control Flow ImplementationThe code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
• CWE-823Use of Out-of-range Pointer OffsetThe product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.