CVE-2026-106074 A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt(
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-106074?
CVE-2026-106074 is a medium-severity vulnerability in nodejs node, published on 23 Oct 2026.
Official description
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.
If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Weakness: CWE-330
Which versions are affected by CVE-2026-106074?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 |
node-min Bitnami | All versions | 22.23.4, 24.22.1, 26.12.1 |
How do I fix CVE-2026-106074?
Upgrade node to a fixed version for your release line: 22.23.4, 24.22.1 or 26.12.1.
Is CVE-2026-106074 being exploited?
There is no known exploitation of CVE-2026-106074 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-106074, AZL-111050, BIT-node-2026-106074, BIT-node-min-2026-106074, DEBIAN-CVE-2026-106074, GHSA-w3gx-6c8w-v66f and 1 more.