Node.js: why two processes could generate the same UUIDs

Node.js advisory from October 21, 2026. CVE-2026-106074 affects applications that make a startup image, or snapshot, after using crypto.randomUUID(), crypto.randomUUIDv7(), or crypto.randomInt(). The Node.js project explains that their internal random caches could be serialized in the snapshot. Each process started from this same image then found the same cache bytes and could produce the same first values. An everyday correct cryptographic generator becomes incorrect if its random state is cloned after initialization.

The cloned cache mechanism

To avoid requesting the random source at each call, a library can obtain a block of bytes and consume it progressively. As long as each process receives an independent block, values ​​remain unpredictable and collisions extremely unlikely. A snapshot reverses the relationship: it captures the state of the process after the block has been filled, then replicates that state to all derived processes. Their first calls consume the same sequence of bytes, in the same order.

Node.js estimates the potential window at 127 UUID and approximately 1000 randomInt() values ​​before filling the cache. These are not 127 identifiers systematically repeated in any application. The flaw requires that an affected function, or an API that uses it such as URL.createObjectURL(), be called during snapshot construction and that descendant processes then use this cache. Without this sequence, simply using randomUUID() does not establish the exposure.

Why impact depends on use

A repeated correlation UUID can mix traces or cause a database key collision. If two processes expose the same sequence of public resource identifiers, an observer may be able to predict an identifier in the other process. A security token constructed from duplicated randomness in this way could be more serious, but the advisory does not say that all Node.js tokens are affected. It is necessary to track the values ​​actually produced by these APIs and the security function they perform. “Repeated UUID” does not by itself mean “bypassed authentication.”

An authorized test builds a snapshot that makes at least one affected call during construction, launches two independent processes from that image, and compares their initial outputs. The negative control compares the same program after correction or without calling during the snapshot build. Useful proof includes how to build the image and the number of calls, because the same code launched without a snapshot can behave normally.

Correct and measure

Node.js announces versions 22.23.4, 24.22.1 and 26.12.1. Teams should identify --build-snapshot and standalone applications that enable useSnapshot, rebuild their artifacts with the patched runtime, and then examine whether credentials already issued have an authorization or only correlation function. Updating the runtime binary without rebuilding a frozen image requires careful control; the goal is to ensure that the cloned state is not reused again.

This flaw illustrates a fundamental property of applied cryptography: the quality of random bytes is not sufficient if the state which distributes them is duplicated. Snapshots save startup time, but they must reset any resources that are intended to be unique to each process.

Primary source: Node.js security publication October 21, 2026.