CVE-2026-41907
Last modified
CVE-2026-41907 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Uuidjs | Uuid | < 11.1.1 |
| Uuidjs | Uuid | 12.0.0 |
| Uuidjs | Uuid | 13.0.0 |
References
- https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pqExploit, Mitigation, Vendor Advisory
- https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pqExploit, Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-41907?
How severe is CVE-2026-41907?
How do I fix CVE-2026-41907?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-41901Thymeleaf is a server-side Java template engine for web and …9
- CVE-2026-41902FreeScout is a free help desk and shared inbox built with PH…9.1
- CVE-2026-41903FreeScout is a free help desk and shared inbox built with PH…5.4
- CVE-2026-41904FreeScout is a free help desk and shared inbox built with PH…7.6
- CVE-2026-41905FreeScout is a free help desk and shared inbox built with PH…7.7
- CVE-2026-41906FreeScout is a free help desk and shared inbox built with PH…7.1
- CVE-2026-41908OpenClaw before 2026.4.20 contains a scope enforcement bypas…6.5
- CVE-2026-41909OpenClaw before 2026.4.20 contains an improper authorization…5.4
- CVE-2026-4191A flaw has been found in JawherKl node-api-postgres up to 2.…7.3
- CVE-2026-41910OpenClaw before 2026.4.8 omits owner-only enforcement for cr…4.3
- CVE-2026-41911OpenClaw before 2026.4.8 contains a filesystem policy bypass…6.5
- CVE-2026-41912OpenClaw before 2026.4.8 contains a server-side request forg…7.6
Are you affected by CVE-2026-41907?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST