Skip to content

fix(deps): update dependency uuid to v11 [security] - #35

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-uuid-vulnerability
Open

fix(deps): update dependency uuid to v11 [security]#35
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-uuid-vulnerability

Conversation

@renovate

@renovate renovate Bot commented May 25, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
uuid ^3.3.2 → ^11.1.1 age confidence

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code
  • src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
  • src/v6.ts writes buf[offset + i] without bounds validation.
Reproducible PoC
cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4()',()=>v4({},new Uint8Array(8),4)],
  ['v5()',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6()',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Observed:

  • v4() THREW RangeError
  • v5() NO_THROW
  • v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
  170, 170, 170, 170,
   75, 224, 100,  63
]
v6 [
  187, 187, 187, 187,
   31,  19, 185,  64
]
Security impact
  • Primary: integrity/robustness issue (silent partial output).
  • If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
  • In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.
Suggested fix

Add the same guard used by v4()/v1()/v7():

if (offset < 0 || offset + 16 > buf.length) {
  throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
}

Apply to:

  • src/v35.ts (covers v3() and v5())
  • src/v6.ts

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

v11.1.1

Compare Source

Bug Fixes

v11.1.0

Compare Source

Features
  • update TS types to allowUint8Array subtypes for buffer option (#​865) (a5231e7)

v11.0.5

Compare Source

Bug Fixes

v11.0.4

Compare Source

Bug Fixes

v11.0.3

Compare Source

Bug Fixes

v11.0.2

Compare Source

Bug Fixes

v11.0.1

Compare Source

Bug Fixes

v11.0.0

Compare Source

⚠ BREAKING CHANGES
  • refactor v1 internal state and options logic (#​780)
  • refactor v7 internal state and options logic, fixes #​764 (#​779)
  • Port to TypeScript, closes #​762 (#​763)
  • update node support matrix (only support node 16-20) (#​750)
Features
Bug Fixes

v10.0.0

Compare Source

⚠ BREAKING CHANGES
  • update node support (drop node@​12, node@​14, add node@​20) (#​750)
Features
Bug Fixes

v9.0.1

Compare Source

build
  • Fix CI to work with Node.js 20.x

v9.0.0

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.3.2

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.3.1

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.3.0

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.2.0

Compare Source

Features
Bug Fixes

v8.1.0

Compare Source

Features
Bug Fixes

v8.0.0

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.3

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.2

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.1

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.0

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v3.4.0

Compare Source

Features

v3.3.3

Compare Source

Bug Fixes
  • no longer run ci tests on node v4
  • upgrade dependencies

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 889691b to ceefa4e Compare May 28, 2026 18:09
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] May 28, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from ceefa4e to 86d202d Compare May 29, 2026 00:05
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] May 29, 2026
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Jun 1, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch 2 times, most recently from 61fa2dd to d23c9ac Compare June 2, 2026 02:14
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Jun 2, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from d23c9ac to fe8e240 Compare June 11, 2026 15:54
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Jun 11, 2026
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Jun 12, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from fe8e240 to c7ea03d Compare June 12, 2026 00:36
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from c7ea03d to fa5a9e5 Compare July 12, 2026 12:59
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Jul 12, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from fa5a9e5 to 5fccca8 Compare July 12, 2026 19:51
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Jul 12, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 5fccca8 to d4e8042 Compare July 17, 2026 11:35
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Jul 17, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from d4e8042 to 8ccf737 Compare July 17, 2026 12:59
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Jul 17, 2026
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Jul 21, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch 2 times, most recently from 75cb523 to 1fa52c1 Compare July 21, 2026 07:08
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Jul 21, 2026
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Jul 24, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 1fa52c1 to 3daf5ea Compare July 24, 2026 17:31
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Jul 25, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 3daf5ea to 6d97391 Compare July 25, 2026 00:28
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Jul 30, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 6d97391 to 4e16a0a Compare July 30, 2026 17:37
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Jul 30, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 4e16a0a to b0e0307 Compare July 30, 2026 22:02
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Aug 11, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch 2 times, most recently from c0cf16b to e09d014 Compare August 12, 2026 04:59
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Aug 12, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from e09d014 to 09af8ac Compare August 14, 2026 18:28
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Aug 14, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 09af8ac to 7fb4e0d Compare August 15, 2026 00:25
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Aug 15, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 7fb4e0d to 2edb916 Compare August 21, 2026 14:02
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Aug 21, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 2edb916 to 3433398 Compare August 21, 2026 20:38
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Aug 21, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 3433398 to b37c613 Compare August 26, 2026 17:05
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Aug 26, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from b37c613 to e16264a Compare August 27, 2026 01:01
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Aug 27, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from e16264a to 06731a2 Compare September 3, 2026 01:07
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Sep 3, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 06731a2 to 19161e3 Compare September 3, 2026 05:55
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Sep 3, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 19161e3 to 914a1cb Compare September 3, 2026 20:56
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v11 [security] fix(deps): update dependency uuid to v14 [security] Sep 3, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 914a1cb to a79a3e1 Compare September 4, 2026 03:36
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants