The official CVE record is not published yet
Listed from the vendor advisory. It will be replaced with the CVE.org / NVD record once published.
Medium
Pre-CVE record
Node.js: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values
CVE-2026-106074
First seen on SecPulse
Summary
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Original description The description as published by the source.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Fixed in: Node.js v22.23.4, v24.22.1, v26.12.1
Source: Node.js Security Releases NVD