Medium, CVSS 6.3npmAmendedPublished
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
CVE-2026-41907 · GHSA-w5hq-g745-h8pq
- Affected
- npm uuid >= 12.0.0, < 12.0.1; >= 13.0.0, < 13.0.1; < 11.1.1
- Fixed in
- 13.0.112.0.111.1.1· Vendor fix available
- Issue
- The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset). By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds. This inconsistency allows silent partial writes into caller-provided buffers. Affected code - src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation. - src/v6.ts writes buf[offset + i] without bounds validation. Reproducible PoC Observed: - v4() THREW RangeError - v5() NOTHROW - v6() NOTHROW Example partial overwrite evidence captured during audit: Security impact - Primary: integrity/robustness issue (silent partial output). - If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error. - In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.…
Recommended action: Upgrade to 13.0.1, 12.0.1 or 11.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.