Testing and rebuilding Node.js snapshot artifacts after CVE-2026-106074
What changed
The Node.js project released fixes for CVE-2026-106074 across the 22.x, 24.x, and 26.x lines. Fixed versions are 22.23.4, 24.22.1, and 26.12.1. The issue is medium severity and involves crypto entropy caches being saved in user-land startup snapshots.
Any release pipeline that creates snapshots or single executable applications with an affected Node.js version needs to determine whether its generated artifacts carry the vulnerable state.
Reproduction boundary
The relevant functions are crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt(). A snapshot build with --build-snapshot, or a single executable application with useSnapshot, is part of the affected path.
If the application invokes one of the random APIs during that build, multiple launches can begin with the same sequence. Node.js documents up to 127 repeated UUIDs and about 1,000 repeated randomInt() results before the cache refills. An indirect call such as URL.createObjectURL() can also involve the cache.
Testing should not attempt to create a usable credential. A safe check uses synthetic startup code and two clean launches from the rebuilt artifact. Record whether the first generated values differ. Keep the test artifact separate from production release channels.
Building a reliable verification
Start by confirming the Node.js version used by the snapshot builder. Base-image tags can be stale, so collect the runtime version from the build environment and record it with the artifact hash.
Next, inspect the initialization path that runs while the snapshot is assembled. Separate code that executes at build time from code that runs only after launch. This distinction identifies whether the entropy cache was touched before serialization.
After upgrading, rebuild the snapshot and executable. Run two isolated processes, capture only a small synthetic sequence, and compare it. Then repeat the production initialization path in staging to catch framework or dependency calls that the direct source search missed.
Operational impact
Repeated early identifiers can break uniqueness assumptions. A process may write to an existing key, combine telemetry, or expose the same value to two parties. When another process's output is observable, the shared sequence can also make later values predictable within the documented cache window.
The advisory does not confirm exploitation. Validation should therefore focus on proving whether the build condition exists and whether sensitive workflows consume the values.
Scope and exposure
The vulnerable version ranges are 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1. A newer runtime does not repair an artifact built earlier.
ZoomEye Search app="Node.js" returned 5,539,619 matches; Filter vul.cve="CVE-2026-106074" returned 0. The exposure value is 5,539,619, but it is a product-fingerprint count and does not establish snapshot usage.
Remediation
Rebuild with a fixed release and replace every affected binary and archived snapshot. Update checksums and signatures. If rebuilding is delayed, remove the affected random calls from snapshot construction and review early identifiers for collisions.
Close the task only after validating the rebuilt artifact itself, not just the build host. A successful runtime version check is useful evidence, but two clean launches from the new artifact provide a more direct test of the behavior.
