{"action":"Upgrade uuid to 11.1.1 or later.","affected":[{"fixed":"11.1.1","introduced":"0"},{"fixed":"12.0.1","introduced":"12.0.0"},{"fixed":"13.0.1","introduced":"13.0.0"}],"component":"uuid","cve_ids":["CVE-2026-41907","CVE-2026-41988"],"ecosystem":"npm","epss":0.0035,"exploited":false,"fixed_versions":["11.1.1","12.0.1","13.0.1"],"ghsa_id":"GHSA-w5hq-g745-h8pq","id":"tcs_01M5KGE0VZ6ANNBV5NW0ECD16M","modified_at":"2026-09-10T03:51:03.663336650Z","published_at":"2026-04-22T20:53:24Z","references":["https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1","https://github.com/uuidjs/uuid/releases/tag/v14.0.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-w5hq-g745-h8pq","url":"https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq"}],"summary":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided"}