Node.js randomInt cache persistence in snapshots: scope and limits
Overview
Node.js has fixed a medium-severity issue in which cached crypto entropy can become part of user-land startup snapshots and single executable applications. CVE-2026-106074 affects the 22.x, 24.x, and 26.x lines and is fixed in 22.23.4, 24.22.1, and 26.12.1.
The named functions are crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt(). The bug does not mean these APIs always return predictable values. It means a specific snapshot build path can preserve cached values for later processes.
What the snapshot stores
A user-land snapshot can retain initialized JavaScript state. The vulnerable runtime includes entropy used by the affected crypto functions in that state. A single executable application built with useSnapshot then packages the snapshot for repeated launches.
Calling a random API during the build is the trigger described by Node.js. Every process started from the resulting artifact can return the same values until the cache is refilled. The advisory gives an upper bound of 127 UUIDs and about 1,000 randomInt() values.
The same cache can be reached through URL.createObjectURL(). A source search limited to crypto APIs can therefore miss a build path that still consumes the random sequence.
Where the risk stops and starts
The official description is specific to snapshots and single executable applications. It does not state that an ordinary Node.js process without a snapshot repeats these outputs. This boundary should prevent overbroad claims during incident triage.
Within that boundary, risk is application-specific. A UUID used only as a display label may cause minor confusion when it collides. A UUID used as a database key can overwrite or merge records. A predictable value used for access requires a direct security review.
The GitHub Advisory Database scores the vulnerability 4.8 on CVSS 3.1, with low confidentiality and integrity impact and no availability impact. The Node.js release page calls it medium. The narrow build condition explains the high attack complexity.
Affected versions
Affected Node.js versions are 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1. Check the compiler that produced each snapshot, not only the runtime version on the application server. An executable may carry state from an older builder.
Exposure context
ZoomEye Search app="Node.js" returned 5,539,619 successful matches. The corresponding vul.cve="CVE-2026-106074" Filter returned 0. Exposure is 5,539,619, but that number represents product fingerprints and does not confirm vulnerable snapshots.
Fix and practical controls
Rebuild with Node.js 22.23.4, 24.22.1, 26.12.1, or a later fixed release. Replace the executable and any archived snapshot that users or services can obtain. Recompute release metadata so consumers do not continue to select the old artifact.
If the rebuild cannot happen immediately, keep the affected random functions out of snapshot construction and review early identifiers created by existing artifacts. Look for duplicate values in structured logs, object stores, and identifiers that appear during process startup.
The public sources do not confirm exploitation. A measured response is to validate the build path, contain exposure if found, and avoid attributing all duplicate UUIDs to this CVE without evidence.
Top comments (0)