CVE-2026-106074: a build-time randomness leak in Node.js snapshots
Summary
CVE-2026-106074 is a Node.js crypto issue caused by entropy cache state being included in user-land startup snapshots. Node.js 22.x, 24.x, and 26.x are affected before 22.23.4, 24.22.1, and 26.12.1. The official project rating is medium.
The phrase "build-time" is important here. A vulnerable value is introduced when a snapshot or single executable application is produced. The artifact can then repeat that value when launched later, long after the build job has finished.
Mechanism
The runtime maintains caches for crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt(). During snapshot construction with --build-snapshot, or production of a single executable application with useSnapshot, the vulnerable implementation can serialize those caches.
If application code calls an affected random function during that construction, the saved cache is not pristine. Later processes start with the same remaining values. The advisory describes up to 127 repeated UUIDs and about 1,000 repeated randomInt() outputs. A later refill ends the repeated segment.
The dependency on application behavior matters. Code that never reaches the cache during the build does not demonstrate the same saved sequence. At the same time, indirect use through URL.createObjectURL() can create an affected path without an obvious crypto call in the application source.
Impact assessment
The CVE record has a CVSS 3.1 score of 4.8. Its confidentiality and integrity impacts are both low, with no availability impact. Network attack vector and no required privileges describe a possible remote observer, while high attack complexity reflects the narrow sequence needed for exploitation.
In practice, the effect starts with broken uniqueness. UUID collisions can cause records to overwrite each other or cause telemetry from separate processes to merge. Predictability matters when another process's output can be observed. Any generated value used as an authorization secret deserves a separate review.
The public advisories do not confirm in-the-wild exploitation. Investigators should avoid describing every duplicated identifier as a compromise.
Scope
The affected versions are 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1. Look at the builder that created a snapshot as well as the runtime that launches it. Archived binaries, test fixtures, and generated release assets can preserve vulnerable state.
Exposure context
ZoomEye Search for app="Node.js" returned 5,539,619 product matches. The CVE filter returned 0. Exposure is 5,539,619 by the selected-query rule, but the result does not establish that those systems use snapshots, run vulnerable builders, or contain repeated values.
Fix and containment
Build again with Node.js 22.23.4, 24.22.1, 26.12.1, or later. Recreate snapshots and single executable applications, then distribute the new artifacts with updated hashes. Verify the build version after the upgrade rather than relying on a generic base-image tag.
A temporary control is to avoid the affected APIs while constructing snapshots. This reduces the chance that a sensitive sequence is frozen, but it does not repair an artifact already created with a vulnerable runtime. The durable fix is a rebuilt artifact from a fixed Node.js release.
