---
id: CVE-2026-106074
title: >-
  nodejs: nodejs: predictable random values via snapshot entropy cache reuse
  (CVE-2026-106074)
summary: >-
  A flaw was found in Node.js crypto. Internal entropy caches used by
  crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be
  saved into user-land startup snapshots (--build-snapshot) and single
  executable applications buil…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-335
  - CWE-330
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-10-23'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T11:03:13+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106074.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106074.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-106074'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2560016'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-106074'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106074'
  - url: 'https://nodejs.org/en/blog/vulnerability/october-2026-security-releases'
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - cve.org
epss: 0.00319
epssPercentile: 0.24713
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/CompleTetech-Security/node-cve-2026-106074-check'
  checkedAt: '2026-10-27T16:54:45.989Z'
exploitAvailable: true
ingestedAt: '2026-10-23T16:31:11.319Z'
---

## Overview

A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. If those APIs (or dependents such as URL.createObjectURL()) run while the snapshot is built, every process started from that snapshot can replay the same initial values until the cache is refilled (on the order of 127 UUIDs and about 1,000 randomInt values). Identifiers expected to be unique may collide across processes, and values from one process may be predictable to an observer of another process started from the same snapshot.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106074.json)

**nodejs: nodejs: predictable random values via snapshot entropy cache reuse** — rated Moderate by Red Hat. Released 2026-10-23, updated 2026-10-26.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat Hardened Images

## Remediation

Fix deferred

Workarounds / mitigations:

- Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation.
Rebuild snapshots after upgrading Node.js, and avoid calling those APIs in the snapshot-build phase.
Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.