CVE-2026-41988

LOW 2.5CVE-2026-41988 · Published 23/04/2026 · updated 26/10/2026

In short

CVE-2026-41988 is a LOW (CVSS 2.5) vulnerability affecting uuid (uuidjs).
Chance of exploitation in the next 30 days (EPSS): 0.18%, higher than 7.8% of all vulnerabilities.
Fix: update to 11.1.1 or later.

Package	Affected versions	Patched versions
uuid uuidjs	`= 12.0.0= 13.0.0< 11.1.1`	`11.1.1`

Description

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.

References

uuidjs/uuid commit 3d2c5b0 · Patch
uuidjs/uuid security advisory · Exploit

More vulnerabilities in uuid

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free