nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

Overview

A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. If those APIs (or dependents such as URL.createObjectURL()) run while the snapshot is built, every process started from that snapshot can replay the same initial values until the cache is refilled (on the order of 127 UUIDs and about 1,000 randomInt values). Identifiers expected to be unique may collide across processes, and values from one process may be predictable to an observer of another process started from the same snapshot.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-26 · vex

nodejs: nodejs: predictable random values via snapshot entropy cache reuse — rated Moderate by Red Hat. Released 2026-10-23, updated 2026-10-26.

Affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9

No fix planned:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9

Not affected:

• Red Hat Hardened Images

Remediation

Fix deferred

Workarounds / mitigations:

• Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.