Low
node-uuid — security advisory
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
- Products
- node-uuid
- Affected versions
- 1.3.3-2, 1.4.0-1, 1.4.7-5, 14.0.0+~11.0.0-1, 14.0.1-1, 3.3.2-2, 8.3.2+~8.3.0-4, 8.3.2+~8.3.3-1, 8.3.2+~8.3.3-4, 8.3.2+~8.3.4-1, 8.3.2+~8.3.4-3
- Fixed versions
- Not specified
- CVEs
- CVE-2026-41988
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:03 UTC · Revision 1
Source evidence
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
osv:UBUNTU-CVE-2026-41988
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: Not specified
Complete source record
{
"id": "1145e52b018f2507e040538f4b2c230bfcda93d9b646c5dadd81e6b5cc821759",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-41988",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-41988",
"summary": "uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.",
"evidence": "osv:UBUNTU-CVE-2026-41988",
"products": [
{
"name": {
"value": "node-uuid",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.3.3-2",
"evidence": "/affected/0/versions"
},
{
"value": "1.4.0-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.4.0-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.4.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.4.7-5",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.2-2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.3.2+~8.3.0-4",
"evidence": "/affected/4/versions"
},
{
"value": "8.3.2+~8.3.3-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.3.2+~8.3.3-4",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.3.2+~8.3.4-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.3.2+~8.3.4-3",
"evidence": "/affected/7/versions"
},
{
"value": "14.0.0+~11.0.0-1",
"evidence": "/affected/7/versions"
},
{
"value": "14.0.1-1",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.3.2+~8.3.4-1",
"evidence": "/affected/8/versions"
},
{
"value": "8.3.2+~8.3.4-3",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "low",
"structured": {
"id": "UBUNTU-CVE-2026-41988",
"aliases": [
"UBUNTU-CVE-2026-41988"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/ubuntu/node-uuid?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"1.3.3-2",
"1.4.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41988.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjs-node-uuid",
"binary_version": "1.4.0-1"
},
{
"binary_name": "node-node-uuid",
"binary_version": "1.4.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/ubuntu/node-uuid?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.4.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41988.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjs-node-uuid",
"binary_version": "1.4.0-1"
},
{
"binary_name": "node-node-uuid",
"binary_version": "1.4.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/ubuntu/node-uuid?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.4.0-1",
"1.4.7-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41988.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjs-node-uuid",
"binary_version": "1.4.7-5"
},
{
"binary_name": "node-node-uuid",
"binary_version": "1.4.7-5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/ubuntu/node-uuid?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"3.3.2-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41988.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-node-uuid",
"binary_version": "3.3.2-2"
},
{
"binary_name": "node-uuid",
"binary_version": "3.3.2-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/ubuntu/node-uuid?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"8.3.2+~8.3.0-4",
"8.3.2+~8.3.3-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41988.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-uuid",
"binary_version": "8.3.2+~8.3.3-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/ubuntu/node-uuid?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"8.3.2+~8.3.3-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41988.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-uuid",
"binary_version": "8.3.2+~8.3.3-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/ubuntu/node-uuid?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"8.3.2+~8.3.4-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41988.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-uuid",
"binary_version": "8.3.2+~8.3.4-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/ubuntu/node-uuid?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"8.3.2+~8.3.4-3",
"14.0.0+~11.0.0-1",
"14.0.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41988.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-uuid",
"binary_version": "14.0.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/ubuntu/node-uuid?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"8.3.2+~8.3.4-1",
"8.3.2+~8.3.4-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41988.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-uuid",
"binary_version": "8.3.2+~8.3.4-3"
}
]
}
}
],
"modified": "2026-10-17T13:00:04.241085175Z",
"provider": "osv",
"upstream": [
"CVE-2026-41988"
],
"references": [
"https://ubuntu.com/security/CVE-2026-41988",
"https://www.cve.org/CVERecord?id=CVE-2026-41988",
"https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"
]
},
"related_cves": [
{
"value": "CVE-2026-41988",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 360247,
"published_at": "2026-04-23T05:16:00+00:00"
}