AIKIDO-2026-10892
uuid is vulnerable to Out-of-bounds Write
63
Medium Risk
This Affects:
uuidTL;DR
The UUID functions v3(), v5(), and v6() could write past the end of a caller-provided buffer when given an invalid offset, because they did not validate that the 16-byte UUID fit within buf.length. The fix adds explicit bounds checks and throws a RangeError when the requested byte range is outside the buffer.
Who does this affect?
If you use v3(), v5(), or v6() with a caller-supplied Uint8Array and an attacker-controlled or otherwise invalid offset, you could be affected prior to this patch version.
Background info
uuid is vulnerable to Out-of-bounds Write in versions 0.0.1 - 10.0.0.
How to fix this
Upgrade the uuid library to the patch version or replace the vulnerable function calls with secure alternatives like v4().
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant