uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

🗓️ 22 Apr 2026 20:53:24Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 710 Views

v3/v5/v6 lack buffer bounds check with external buffers, causing silent partial writes; add RangeError guard.

Reporter	Title	Published	Views	Family All 50
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses uuid-8.3.2.tgz, uuid-9.0.1.tgz which is vulnerable to CVE-2026-41907	29 May 202610:36	–	ibm
IBM Security Bulletins	Security Bulletin: TDI is vulnerable to do not reject out of range writes due to uuid-11.1.0 - CVE-2026-41907	25 May 202611:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in uuid-3.3.2.tgz	9 Jun 202615:07	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in uuid-9.0.1.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-41907)	29 May 202609:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses uuid-9.0.1.tgz which is vulnerable to CVE-2026-41988, CVE-2026-41907	1 Jun 202608:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses uuid-9.0.1.tgz which is vulnerable to CVE-2026-41988, CVE-2026-41907	1 Jun 202611:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in uuid (CVE-2026-41907)	31 May 202616:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses uuid-7.0.3.tgz, uuid-9.0.1.tgz which is vulnerable to CVE-2026-41907	29 May 202608:47	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials	12 Jun 202601:05	–	ibm

Vulners

Node

data::uuid_project data::uuidRange<11.1.1npm

data::uuid_project data::uuidRange13.0.0–13.0.1npm

data::uuid_project data::uuidRange12.0.0–12.0.1npm

Source	Link
github	www.github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq
github	www.github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34
github	www.github.com/uuidjs/uuid/releases/tag/v14.0.0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41907
github	www.github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e
github	www.github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d
github	www.github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a
github	www.github.com/uuidjs/uuid/releases/tag/v11.1.1
github	www.github.com/uuidjs/uuid/releases/tag/v12.0.1
github	www.github.com/uuidjs/uuid/releases/tag/v13.0.1

21 May 2026 18:25Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

CVSS 49.3

EPSS0.00311

SSVC