LowFix available
node-uuid — security advisory
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
- Products
- node-uuid
- Affected versions
- 14.0.0+~11.0.0-1, 14.0.1-1, 14.0.2-1, 14.0.3-1, 14.0.3-2, 8.3.2+~8.3.3-3, 8.3.2+~8.3.3-4, 8.3.2+~8.3.4-1, 8.3.2+~8.3.4-2, 8.3.2+~8.3.4-3
- Fixed versions
- 14.0.0+~11.0.0-1
- CVEs
- CVE-2026-41988
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:51 UTC · Revision 2
Source evidence
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
osv:DEBIAN-CVE-2026-41988
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: Not specified
node-uuid
Fixed versions: 14.0.0+~11.0.0-1
Complete source record
{
"id": "737e93494afb465a86a0a10236b9fe86aae416cb66da3f693e846274e366c951",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-41988",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-41988",
"summary": "uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.",
"evidence": "osv:DEBIAN-CVE-2026-41988",
"products": [
{
"name": {
"value": "node-uuid",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "14.0.0+~11.0.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "14.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "14.0.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "14.0.3-1",
"evidence": "/affected/0/versions"
},
{
"value": "14.0.3-2",
"evidence": "/affected/0/versions"
},
{
"value": "8.3.2+~8.3.3-3",
"evidence": "/affected/0/versions"
},
{
"value": "8.3.2+~8.3.3-4",
"evidence": "/affected/0/versions"
},
{
"value": "8.3.2+~8.3.4-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.3.2+~8.3.4-2",
"evidence": "/affected/0/versions"
},
{
"value": "8.3.2+~8.3.4-3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "14.0.0+~11.0.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "14.0.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "14.0.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "14.0.3-1",
"evidence": "/affected/1/versions"
},
{
"value": "14.0.3-2",
"evidence": "/affected/1/versions"
},
{
"value": "8.3.2+~8.3.4-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.3.2+~8.3.4-2",
"evidence": "/affected/1/versions"
},
{
"value": "8.3.2+~8.3.4-3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "node-uuid",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.0.0+~11.0.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "8.3.2+~8.3.4-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.3.2+~8.3.4-2",
"evidence": "/affected/2/versions"
},
{
"value": "8.3.2+~8.3.4-3",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "low",
"structured": {
"id": "DEBIAN-CVE-2026-41988",
"aliases": [
"DEBIAN-CVE-2026-41988"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/debian/node-uuid?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"14.0.0+~11.0.0-1",
"14.0.1-1",
"14.0.2-1",
"14.0.3-1",
"14.0.3-2",
"8.3.2+~8.3.3-3",
"8.3.2+~8.3.3-4",
"8.3.2+~8.3.4-1",
"8.3.2+~8.3.4-2",
"8.3.2+~8.3.4-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41988.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/debian/node-uuid?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"14.0.0+~11.0.0-1",
"14.0.1-1",
"14.0.2-1",
"14.0.3-1",
"14.0.3-2",
"8.3.2+~8.3.4-1",
"8.3.2+~8.3.4-2",
"8.3.2+~8.3.4-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41988.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.0.0+~11.0.0-1"
}
]
}
],
"package": {
"name": "node-uuid",
"purl": "pkg:deb/debian/node-uuid?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"8.3.2+~8.3.4-1",
"8.3.2+~8.3.4-2",
"8.3.2+~8.3.4-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41988.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-27T10:01:22.592785656Z",
"provider": "osv",
"upstream": [
"CVE-2026-41988"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-41988"
]
},
"related_cves": [
{
"value": "CVE-2026-41988",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 461383,
"published_at": "2026-04-23T05:16:05.613+00:00"
}