Description
The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.
Recommendation
Update the uuid package to the latest compatible version. Followings are version details:
Affected version(s): **< 11.1.1 >= 13.0.0, < 13.0.1 >= 12.0.0, < 12.0.1** Patched version(s): **11.1.1 13.0.1 12.0.1**
References
Could your website be exposed too?
SmartScanner can check your website for uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided and gives you actionable findings to investigate.
Start a free scanRelated Issues
- StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check - CVE-2026-32101
- StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts - CVE-2026-32106
- Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex - CVE-2026-45395
- @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - CVE-2026-49993
You might also like:
See something that needs correcting? Let us knowUpdated May 21, 2026