uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Description

The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

Recommendation

Update the uuid package to the latest compatible version. Followings are version details:

• Affected version(s): **< 11.1.1

  >= 13.0.0, < 13.0.1

  >= 12.0.0, < 12.0.1**

• Patched version(s): **11.1.1

  13.0.1

  12.0.1**

References

• GHSA-w5hq-g745-h8pq
• CVE-2026-41907
• CWE-1285
• CWE-787
• CAPEC-310
• OWASP 2021-A6

Related Issues

• StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check - CVE-2026-32101
• StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts - CVE-2026-32106
• Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex - CVE-2026-45395
• @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - CVE-2026-49993

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

uuid