VulnerabilityAnalyzed

CVE-2026-41988

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6.

LOW 2.5EPSS 0.18%

Does this matter?

Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.

Description

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.

CVSS 3.1: 2.5 LOWCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.18% probability · 8th percentile
CISA KEV: Not listed
Weakness: CWE-670
Affected: uuidjs/uuid
Source: cve@mitre.org

References

https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34Patch
https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pqExploit, Vendor Advisory
https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pqExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.