Came across something in package-lock.json around line 8929 that looked worth flagging.
The uuid package versions prior to 14.0.0 fail to validate buffer lengths and offsets when writing identifiers via the v3, v5, and v6 methods. This insufficient bounds checking permits silent out-of-bounds partial writes to caller-provided buffers, risking memory corruption, data leakage, or application instability. While classified as Medium severity, the memory safety implications warrant immediate remediation to prevent potential exploitation or runtime failures.
Something like this might fix it:
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
"dependencies": {
"express": "^4.18.2",
- "uuid": "9.0.1",
+ "uuid": "^14.0.0"
}
}
---
Apply this dependency update and execute `npm install` to regenerate package-lock.json with the patched version (>=14.0.0).For reference: rule CVE-2026-41907. Rated high.
I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
package-lock.jsonaround line 8929 that looked worth flagging.The uuid package versions prior to 14.0.0 fail to validate buffer lengths and offsets when writing identifiers via the v3, v5, and v6 methods. This insufficient bounds checking permits silent out-of-bounds partial writes to caller-provided buffers, risking memory corruption, data leakage, or application instability. While classified as Medium severity, the memory safety implications warrant immediate remediation to prevent potential exploitation or runtime failures.
Something like this might fix it:
For reference: rule
CVE-2026-41907. Rated high.I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.