GHSA-w5hq-g745-h8pq

Опубликовано: 22 апр. 2026

Источник: github

Github: Прошло ревью

CVSS4: 6.3

CVSS3: 7.5

Описание

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Summary

The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid npm ci npm run build node --input-type=module -e " import {v4,v5,v6} from './dist-node/index.js'; const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8'; for (const [name,fn] of [ ['v4()',()=>v4({},new Uint8Array(8),4)], ['v5()',()=>v5('x',ns,new Uint8Array(8),4)], ['v6()',()=>v6({},new Uint8Array(8),4)], ]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); } }"

Observed:

v4() THREW RangeError
v5() NO_THROW
v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [ 170, 170, 170, 170, 75, 224, 100, 63 ] v6 [ 187, 187, 187, 187, 31, 19, 185, 64 ]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4()/v1()/v7():

if (offset < 0 || offset + 16 > buf.length) { throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`); }

Apply to:

src/v35.ts (covers v3() and v5())
src/v6.ts

Ссылки

Пакеты

Наименование

uuid

npm

Затронутые версииВерсия исправления

< 11.1.1

11.1.1

Наименование

uuid

npm

Затронутые версииВерсия исправления

>= 12.0.0, < 12.0.1

12.0.1

Наименование

uuid

npm

Затронутые версииВерсия исправления

>= 13.0.0, < 13.0.1

13.0.1

EPSS

Процентиль: 26%

0.00337

Низкий

6.3 Medium

CVSS4

7.5 High

CVSS3

CVE ID

CVE-2026-41907

Дефекты

CWE-1285

CWE-787

Связанные уязвимости

CVE-2026-41907

CVSS3: 7.5

ubuntu

3 месяца назад

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

CVE-2026-41907

CVSS3: 4.8

redhat

3 месяца назад

CVE-2026-41907

CVSS3: 7.5

nvd

3 месяца назад

CVE-2026-41907

msrc

3 месяца назад

uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

CVE-2026-41907

CVSS3: 7.5

debian

3 месяца назад

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to ...

EPSS

Процентиль: 26%

0.00337

Низкий

6.3 Medium

CVSS4

7.5 High

CVSS3

CVE ID

CVE-2026-41907

Дефекты

CWE-1285

CWE-787